Active Directory: User Accounts With Brute Force Attempts Not Disabled Count | Voters

Active Directory: User Accounts With Brute Force Attempts Not Disabled Count

submitted

Ben Jones

Excluding disabled accounts helps with an accurate count of brute force accounts.

Users[?AnomalousActivity.contains(@,

Brute Force

) && UserStatus ==

Active

] | length(@)