Query

IdentityDirectoryEvents
| where ActionType == @"Account Path changed"
| extend FROMAccountPath = parse_json(AdditionalFields)["FROM Account Path"]
| extend TOAccountPath = parse_json(AdditionalFields)["TO Account Path"]
| project Timestamp, TargetAccountUpn, TargetDeviceName, FROMAccountPath, TOAccountPath

About this query

Active Directory - User or Device object OU moves

Query Information

Description

Use the below query to find Active Directory User or Device Object OU moves

References

Microsoft Defender XDR

Explanation

This KQL (Kusto Query Language) query is designed to identify and display instances where Active Directory user or device objects have been moved between Organizational Units (OUs). Here's a simple breakdown of what the query does:

Data Source: It starts by accessing the IdentityDirectoryEvents table, which contains events related to identity directory activities.
Filter: It filters the data to only include events where the ActionType is "Account Path changed". This indicates that the path of a user or device account in Active Directory has been altered, suggesting a move between OUs.
Extract Information:
- It uses the parse_json function to extract the original and new account paths from the AdditionalFields column, storing them in FROMAccountPath and TOAccountPath respectively.
Select Columns: Finally, it selects and displays the following columns:
- Timestamp: The time when the OU move occurred.
- TargetAccountUpn: The User Principal Name of the account that was moved.
- TargetDeviceName: The name of the device if a device account was moved.
- FROMAccountPath: The original OU path before the move.
- TOAccountPath: The new OU path after the move.

In summary, this query helps track and review changes in the organizational structure of user or device accounts within Active Directory by showing when and where these accounts have been moved.

KQL Search