topic Splunk Supporting Add-on for Active Directory: What privileges are required for the domain user who connects to the domain? in All Apps and Add-ons

Splunk Supporting Add-on for Active Directory: What privileges are required for the domain user who connects to the domain?

sivakumarm — Fri, 02 Mar 2018 17:48:54 GMT

Could anyone please help me to find out the AD privileges required for domain service account that splunk uses to connect and query active directory database.

Re: Splunk Supporting Add-on for Active Directory: What privileges are required for the domain user who connects to the

ownion — Mon, 04 Jan 2021 10:45:52 GMT

Hi @sivakumarm, I also need this information but I couldn't find anything in the documentation or online.

Have you fixed this problem? How?

A classic Domain User is enough?

Thanks.

Re: Splunk Supporting Add-on for Active Directory: What privileges are required for the domain user who connects to the

scelikok — Mon, 04 Jan 2021 10:49:18 GMT

Hi,

Any Domain User account is enough for this add-on. There is no privilege required.

If this reply helps you an upvote is appreciated.

Re: Splunk Supporting Add-on for Active Directory: What privileges are required for the domain user who connects to the

DenM — Mon, 04 Jan 2021 12:56:40 GMT

Hello @sivakumarm ,

In the Splunk side you need for the Splunk Supporting Add-on for Active Directory the admin_all_objects capability to read storage passwords. The user has this capability by default. If you want to use the add on with the non-admin user, then you must have this capability added to its profile.

in the Microsoft side you only need a domain user (enough to discover the Active Directory)

You can find all the informations in the official documentation from Splunk for this add-on:

Configure the Splunk Supporting Add-on for Active Directory - Splunk Documentation

Regards

Den