https://community.splunk.com/t5/Getting-Data-In/splunk-forwarder-Remote-login-has-been-disabled-for-admin-with/m-p/690664#M114906 <P>Have you tried the second option (allowRemoteLogin)? I can't say I've seen this myself, but it could be that you need to temporarily change that setting to get around the default password problem. If that works, then once you've changed your password, you should be able to revert the allowRemoteLogin setting.<BR /><BR />The following should help for values:</P><LI-CODE lang="markup"># The following 'allowRemoteLogin' setting controls remote management of your splunk instance. # - If set to 'always', all remote logins are allowed. # - If set to 'never', only local logins to splunkd will be allowed. Note that this will still allow # remote management through splunkweb if splunkweb is on the same server. # - If set to 'requireSetPassword' (default behavior): # 1. In the free license, remote login is disabled. # 2. In the pro license, remote login is only disabled for the admin user that has not changed their default password</LI-CODE> Thu, 13 Jun 2024 23:22:49 GMT P_vandereerden 2024-06-13T23:22:49Z https://community.splunk.com/t5/Getting-Data-In/splunk-forwarder-Remote-login-has-been-disabled-for-admin-with/m-p/690662#M114905 <P>Upgraded universal splunk universal forwarder from 9.0.2 to 9.1.0.&nbsp;</P><P>./splunk list monitor gives me the following error with default password : "<SPAN>Remote login has been disabled for 'admin' with the default password. Either set the password, or override by changing the 'allowRemoteLogin' setting in your server.conf file." for the first time.</SPAN></P><P><SPAN>./splunk edit user admin -password &lt;newpassword&gt; -auth admin:changeme</SPAN></P><P><SPAN>tried above command to reset default password: still gives me :&nbsp;"Remote login has been disabled for 'admin' with the default password. Either set the password, or override by changing the 'allowRemoteLogin' setting in your server.conf file."</SPAN></P><P><SPAN>Looking for any answers.</SPAN></P> Thu, 13 Jun 2024 21:49:25 GMT https://community.splunk.com/t5/Getting-Data-In/splunk-forwarder-Remote-login-has-been-disabled-for-admin-with/m-p/690662#M114905 mikki 2024-06-13T21:49:25Z https://community.splunk.com/t5/Getting-Data-In/splunk-forwarder-Remote-login-has-been-disabled-for-admin-with/m-p/690664#M114906 <P>Have you tried the second option (allowRemoteLogin)? I can't say I've seen this myself, but it could be that you need to temporarily change that setting to get around the default password problem. If that works, then once you've changed your password, you should be able to revert the allowRemoteLogin setting.<BR /><BR />The following should help for values:</P><LI-CODE lang="markup"># The following 'allowRemoteLogin' setting controls remote management of your splunk instance. # - If set to 'always', all remote logins are allowed. # - If set to 'never', only local logins to splunkd will be allowed. Note that this will still allow # remote management through splunkweb if splunkweb is on the same server. # - If set to 'requireSetPassword' (default behavior): # 1. In the free license, remote login is disabled. # 2. In the pro license, remote login is only disabled for the admin user that has not changed their default password</LI-CODE> Thu, 13 Jun 2024 23:22:49 GMT https://community.splunk.com/t5/Getting-Data-In/splunk-forwarder-Remote-login-has-been-disabled-for-admin-with/m-p/690664#M114906 P_vandereerden 2024-06-13T23:22:49Z https://community.splunk.com/t5/Getting-Data-In/splunk-forwarder-Remote-login-has-been-disabled-for-admin-with/m-p/690681#M114907 <P>setting "allowRemoteLogin" in server.conf did allow default password and then I changed the password using above ./splunk edit user ...</P><P>Thanks.</P> Fri, 14 Jun 2024 03:37:03 GMT https://community.splunk.com/t5/Getting-Data-In/splunk-forwarder-Remote-login-has-been-disabled-for-admin-with/m-p/690681#M114907 mikki 2024-06-14T03:37:03Z