topic Installing Splunk 9.1.1.0 as a Local Admin on Windows OS using Ansible Playbook in Getting Data In

Installing Splunk 9.1.1.0 as a Local Admin on Windows OS using Ansible Playbook

FAA — Mon, 06 Nov 2023 10:49:39 GMT

Hi,

most of the splunk forwarder installed on servers are on NT Authority and will like to change this to local admin. I have tried modifying the ansible roles to fix the this but havent been successful any ideas on what can be done will be appreciated.

Re: Installing Splunk 9.1.1.0 as a Local Admin on Windows OS using Ansible Playbook

FelixLeh — Mon, 06 Nov 2023 11:23:58 GMT

Everything that is needed should hopefully be found here:
https://docs.splunk.com/Documentation/Forwarder/9.1.1/Forwarder/InstallaWindowsuniversalforwarderfromaninstaller

LOGON_USERNAME="<domain\username>"

LOGON_PASSWORD="<pass>"

Provide domain\username and password information for the user to run the SplunkForwarder service. Specify the domain with the username in the format: domain\username. If you don't include these flags, the universal forwarder installs as the Local System user.

The Troubleshooting at the bottom of the link could also lead to answers regarding permissions and local admin groups

Re: Installing Splunk 9.1.1.0 as a Local Admin on Windows OS using Ansible Playbook

FAA — Thu, 09 Nov 2023 09:33:47 GMT

Please how can I change from the default NT Authority to Local System account as the service Logon . I am trying to do this with Ansible

Re: Installing Splunk 9.1.1.0 as a Local Admin on Windows OS using Ansible Playbook

dural_yyz — Thu, 09 Nov 2023 13:45:58 GMT

USE_LOCAL_SYSTEM

Install the universal forwarder as a local system

The default flag on install is 0 - update the install line to flag this set to 1.

This is no longer best practice for security so be prepared to update future installs to fit with best practices.