https://community.splunk.com/t5/Security/New-Install-Default-Credentials-Invalid/m-p/322141#M8317 <P>Did you manually check the splunkd.log for any clues ?</P> Sun, 09 Apr 2017 05:25:40 GMT pradeepkumarg 2017-04-09T05:25:40Z https://community.splunk.com/t5/Security/New-Install-Default-Credentials-Invalid/m-p/322140#M8316 <P>I installed Splunk Enterprise 6.5.3 on a new WS2012R2 Core VM. I completed the install, changed the services to use a gMSA account and setup relevant groups and GPO settings. I set the services to logon with the gMSA account and started Splunkd and opened <A href="http://splunk:8000">http://splunk:8000</A>.</P> <P>After getting to the webpage, I attempted to login with 'admin' and 'changeme'. The login attempt failed and I tried it a few more times, to make sure it wasn't me. After that I tried IE, thinking that there could be an issue with Firefox, but the login failed there as well. I did some searching on the Internet and noted mentions of the /etc/passwd file within $splunk_home. I went to the /etc folder on my system and found that it does not have the passwd file.</P> <P>Any ideas as to what the issue is? Is there a way I can change the password though the CLI? I ran splunk edit user admin -password changeme -role admin -auth admin:password and the command is sitting there without completing or erroring out.</P> Sat, 08 Apr 2017 19:32:11 GMT https://community.splunk.com/t5/Security/New-Install-Default-Credentials-Invalid/m-p/322140#M8316 m314219 2017-04-08T19:32:11Z https://community.splunk.com/t5/Security/New-Install-Default-Credentials-Invalid/m-p/322141#M8317 <P>Did you manually check the splunkd.log for any clues ?</P> Sun, 09 Apr 2017 05:25:40 GMT https://community.splunk.com/t5/Security/New-Install-Default-Credentials-Invalid/m-p/322141#M8317 pradeepkumarg 2017-04-09T05:25:40Z https://community.splunk.com/t5/Security/New-Install-Default-Credentials-Invalid/m-p/322142#M8318 <P>To reset the admin password you will need to have access to the file system. Rename/move the <CODE>$SPLUNK_HOME/etc/passwd</CODE> and restart splunk and the passwd file will be recreated with one login as <CODE>admin</CODE> and PW <CODE>changeme</CODE>.</P> Sun, 09 Apr 2017 19:02:04 GMT https://community.splunk.com/t5/Security/New-Install-Default-Credentials-Invalid/m-p/322142#M8318 woodcock 2017-04-09T19:02:04Z https://community.splunk.com/t5/Security/New-Install-Default-Credentials-Invalid/m-p/322143#M8319 <P>The passwd file did not exist. I'm thinking something went wrong with the install, as a new install worked fine.</P> Sat, 03 Jun 2017 14:43:09 GMT https://community.splunk.com/t5/Security/New-Install-Default-Credentials-Invalid/m-p/322143#M8319 m314219 2017-06-03T14:43:09Z https://community.splunk.com/t5/Security/New-Install-Default-Credentials-Invalid/m-p/322144#M8320 <P>I just installed and instance of Splunk on Windows and the default ID and PSSWD says invalid even after I rename the passwd file and restart splunk. When i start splunk it is showing the user id and password that i used to download the software.</P> Thu, 26 Apr 2018 13:54:57 GMT https://community.splunk.com/t5/Security/New-Install-Default-Credentials-Invalid/m-p/322144#M8320 cfonmedig 2018-04-26T13:54:57Z