https://community.splunk.com/t5/Getting-Data-In/Active-Directory-Monitoring/m-p/101405#M21244 <P>I was wondering if someone could validate an answer for me. I have installed the Universal Forwarder on a domain controller and collecting data. However, there is also the Manager » Data inputs » Active Directory monitoring within Splunk. Do these collect the same data? Can I assume that using the Universal Forwarder is the preferred method to collect AD data?</P> <P>Thanks!</P> Mon, 26 Mar 2012 18:23:13 GMT seanp 2012-03-26T18:23:13Z https://community.splunk.com/t5/Getting-Data-In/Active-Directory-Monitoring/m-p/101405#M21244 <P>I was wondering if someone could validate an answer for me. I have installed the Universal Forwarder on a domain controller and collecting data. However, there is also the Manager » Data inputs » Active Directory monitoring within Splunk. Do these collect the same data? Can I assume that using the Universal Forwarder is the preferred method to collect AD data?</P> <P>Thanks!</P> Mon, 26 Mar 2012 18:23:13 GMT https://community.splunk.com/t5/Getting-Data-In/Active-Directory-Monitoring/m-p/101405#M21244 seanp 2012-03-26T18:23:13Z https://community.splunk.com/t5/Getting-Data-In/Active-Directory-Monitoring/m-p/101406#M21245 <P>The Active Directory monitoring process (<CODE>splunk-admon.exe</CODE>) can run under your full Splunk instance or on a forwarder. If you haven't read the <A href="http://docs.splunk.com/Documentation/Splunk/latest/Data/AuditActiveDirectory">Monitor Active Directory</A> documentation topic, that's a good place to start.</P> Mon, 26 Mar 2012 18:37:35 GMT https://community.splunk.com/t5/Getting-Data-In/Active-Directory-Monitoring/m-p/101406#M21245 ChrisG 2012-03-26T18:37:35Z