Scenario: We're doing an active directory upgrade which will effect applications that currently point to specific domain controller for authentication.
We have so many applications in use right now and some stem back to before when most of us were employed. I'm wondering if there's any way to construct something within Splunk that would be able to track applications that are authenticating via. active directory. Would it just give the servers the apps are housed on or is there a way to get specific information relating to the application itself?
I believe my first step is to get Splunk on the domain controllers, after that I'm unsure and I just wanted to see if this was something anyone on here has ever dealt with or had experience with.
As always thanks to anyone who takes the time out to read this and even more thanks if anyone has suggestions!
↧