Forum Discussion
KQL for list of service account with password never expires.
Hi Can someone please help me, how to write KQL query to get list of all service accounts which are set to password never expires. Thank you for your time.
As long as 'UserAccountControl' is being parsed from IdentityInfo,
use this:
IdentityInfo
| where OnPremisesDistinguishedName contains "Service" and OnPremisesDistinguishedName contains "account"
| where UserAccountControl has "PasswordNeverExpires"
| summarize arg_max(TimeGenerated, *) by AccountName
| project AccountName, AccountCreationTime, AccountDomain, AccountUPN, OnPremisesDistinguishedName, UserAccountControl
Set the time range to go as far back as you can.