https://community.splunk.com/t5/Splunk-Enterprise/Running-Splunk-Forwarder-on-domain-controller-limited-privileges/m-p/419353#M7693 <P>From everything I found online about this, it seems to actually require local Administrator permissions...</P> Sat, 26 May 2018 10:46:22 GMT xpac 2018-05-26T10:46:22Z https://community.splunk.com/t5/Splunk-Enterprise/Running-Splunk-Forwarder-on-domain-controller-limited-privileges/m-p/419352#M7692 <P>I've set up the service account using the guidelines here:</P> <P>=https=://<A href="http://www.splunk.com/blog/2013/04/15/enabling-splunk-as-a-windows-domain-user-with-group-policy.html">www.splunk.com/blog/2013/04/15/enabling-splunk-as-a-windows-domain-user-with-group-policy.html</A></P> <P>With the exception of "Act as part of the operating system" because this basically makes the account a domain admin.</P> <P>However, I'm still getting a ton of these errors in the splunkd.log:</P> <P>ERROR ExecProcessor - message from ""D:\Program Files\SplunkUniversalForwarder\bin\splunk-netmon.exe"" splunk-netmon - NetmonEvent::GetUserInfo: Warning LsaGetLogonSessionData failed with : 0xc0000022</P> <P>Any suggestions on what permission I need to assign explicitly to overcome this?</P> <P>Thanks!</P> Fri, 25 May 2018 21:44:01 GMT https://community.splunk.com/t5/Splunk-Enterprise/Running-Splunk-Forwarder-on-domain-controller-limited-privileges/m-p/419352#M7692 fnbrown 2018-05-25T21:44:01Z https://community.splunk.com/t5/Splunk-Enterprise/Running-Splunk-Forwarder-on-domain-controller-limited-privileges/m-p/419353#M7693 <P>From everything I found online about this, it seems to actually require local Administrator permissions...</P> Sat, 26 May 2018 10:46:22 GMT https://community.splunk.com/t5/Splunk-Enterprise/Running-Splunk-Forwarder-on-domain-controller-limited-privileges/m-p/419353#M7693 xpac 2018-05-26T10:46:22Z