topic Re: Splunk User of windows SplunkForwarder in Getting Data In

Splunk User of windows SplunkForwarder

maede_yavari — Mon, 22 Jan 2024 08:54:11 GMT

Hello,

I'm encountering an issue with Splunk Forwarder on a Windows Server OS. When it runs under the "SplunkForwarder" user, it fails to send Sysmon logs. Surprisingly, the forwarding works correctly when the forwarder is configured to run as the "SYSTEM" user.

While this resolves the immediate problem, I'm hesitant to continue using the "SYSTEM" user due to its extensive access to system resources. I'm seeking a better solution that allows the Splunk Forwarder to send Sysmon logs without compromising security. Any guidance on this matter would be greatly appreciated.

Thank you.

Re: Splunk User of windows SplunkForwarder

gcusello — Mon, 22 Jan 2024 09:58:07 GMT

Hi @maede_yavari,

this isn't a Splunk issue: if you want to have more security running Splunk Universal Forwarder with a not LOCAL SYSTEM user, you have to give to the user that you're using the grants to read you eventlog: you need a Windows technician, or you could accept to run Splunk using SYSTEM.

Ciao.

Giuseppe

Re: Splunk User of windows SplunkForwarder

Shahrukh_S — Thu, 11 Jul 2024 08:13:51 GMT

"NT service\splunkforwarder" does not have native permission levels to read from all the windows log channels, especially the SECURITY log channel and SYSMON channels. The easiest option is to add "NT Service\SplunkForwarder" object to the "Event Log Readers" group in the system.

Or create a domain user, restart all the instances of SplunkForwarder service with the newly created domain user and come up with a GPO to add the domain user to "Event Log Readers".

Re: Splunk User of windows SplunkForwarder

whrg — Wed, 14 Aug 2024 16:13:29 GMT

Many thanks! I was troubleshooting why Splunk was not reading out the Security event log. After adding "NT Service\SplunkForwarder" to the "Event Log Readers" group, it finally works.

Re: Splunk User of windows SplunkForwarder

isoutamo — Wed, 14 Aug 2024 19:09:01 GMT

Please read this https://docs.splunk.com/Documentation/Splunk/9.3.0/Installation/ChoosetheuserSplunkshouldrunas
It describes how splunk works in windows and which kind of user you should select to fulfill your requirements.

Re: Splunk User of windows SplunkForwarder

gcusello — Fri, 16 Aug 2024 07:05:32 GMT

Hi @whrg ,

good for you, see next time!

let us know if we can help you more, or, please, accept one answer for the other people of Community.

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated by all the contributors 😉

Re: Splunk User of windows SplunkForwarder

jhoney12 — Sat, 17 Aug 2024 08:01:51 GMT

This discussion has been very informative.