In light of macOS Server removing the Account Lockout Policy Enforcement feature from the GUI, one can still apply this enforcement by way of terminal command on the Open Directory Server itself. For Example:
Set LDAP Account Policy Enforcement:
pwpolicy -a <<diradmin>> -p <<password>> -u <<username to unlock> -setpolicy "maxFailedLoginAttempts=1"
** This sets 5 password failed attempts along with 60days password reset
sudo pwpolicy -a diradmin -u edtester -setpolicy "maxMinutesUntilChangePassword=86400 maxFailedLoginAttempts=5"
pwpolicy -a <<diradmin>> -p <<password>> -u <<username to unlock> -setpolicy "isDisabled=0"
Link to technical article: https://superuser.com/questions/577273/osx-server-ldap-pwpolicy-how-to-disable-a-account
Splunk forum member: lguinn2 shows us to:
Put the following in the configuration file web.conf (perhaps in etc/system/local or etc/apps/search/local)
Your message here
Found information here: https://answers.splunk.com/answers/320607/is-there-way-to-add-a-warning-message-in-splunk-we.html
Run AdobeExpiryCheck tool
Run AdobeExpiryCheck on a local Windows machine
Launch command prompt and run the AdobeExpiryCheck tool.
The tool displays the product licensing identifier, the encrypted serial number, and the expiration date.
Link to Adobe Creative Cloud Software: Adobe Creative Cloud 12-month Plan Subscription
Timothy Sutton timsutton – Bromont, Québec – Tim has written a script that packages adobe serialization tools
This is a command-line tool that makes it easier to deploy Adobe Creative Cloud device license files (output by the Creative Cloud Packager application) on OS X, by building them into a standard OS X package installer.
Timothy Sutton timsutton – Bromont, Québec
Rich Mahlerwein writes on a Splunk comment:
Carefully craft a search that returns those rows and ONLY those rows. There’s isn’t enough information here to know precisely what it is that search will look like.
You could start by doing something like a
* | stats count by sourcetype to find out what sourcetype the ones you want to get rid of are, since I think this is your determining factor (remove all of that older sourcetype).
Once you’ve determined the sourcetype (or anything unique) of the data you want to remove, craft yourself a search that displays just those events. Perhaps
Make double sure this works right. It should include ALL the rows you want to have removed, but include NO rows that you want to keep. This is the search we’ll use to actually do the delete with.
Then follow the steps in the documentation on removing data from indexes using YOUR search to prevent those results from showing up again. To recap “how to delete data” from the docs, it’s basically
1) Add “delete” capabilities to a role (preferably use a special user)
2) Log in as that role
3) Use that search we made above, double-check that it returns the right data and only that data.
4) Then run
that search | delete
5) Watch the output, it’ll tell you how many events got deleted.
Then log OUT as that special user (and I’d suggest disabling it, but you can do what you want), log back in as your usual user and check that you only have the right data in there now.
This is all thanks to: