https://community.splunk.com/t5/Getting-Data-In/Windows-Server-2012-Splunkd-Service-Access-Denied/m-p/17874#M2388 <P>In case anyone else is encountering this issue: </P> <P>We fixed this in a kind of roundabout way. The Splunk server was a Server 2012 on a VMware VM. I had to go in and disable the hotplug ability on the guest. This allowed the services to run under a domain service account but for some reason it cut off all network access to the server. </P> <P>I then added a second NIC, booted up the VM and network connectivity was restored but the services failed again. After that I shutdown the machine, removed the new NIC and powered back on. For some reason network connectivity is restored and the splunk services are running under the domain account. I will update this entry as I find more information.</P> Tue, 05 Feb 2013 23:58:58 GMT UserFriendly 2013-02-05T23:58:58Z https://community.splunk.com/t5/Getting-Data-In/Windows-Server-2012-Splunkd-Service-Access-Denied/m-p/17873#M2387 <P>We're having a bit of an issue with our new Splunk install on Windows Server 2012. The Splunkd and Splunkweb services will not start when using a domain service account. They fail with a "Access Denied" message. </P> <P>We're using a Domain Admin account and have verified that the following Local Policies were set for it:<BR /><BR /> Permission to log on as a service<BR /><BR /> Permission to log on as a batch job<BR /><BR /> Permission to replace a process-level token<BR /><BR /> Permission to act as part of the operating system<BR /><BR /> Permission to bypass traverse checking </P> <P>I also verified that we do not have "Permission to log on as a service" set as a GPO - so that shouldn't be overiding the local policy. </P> <P>Has anyone else had any experience with this? I've been racking my brain for 2 days trying to figure this one out and would greatly appreciate any direction in the matter. Thanks!</P> Sun, 03 Feb 2013 08:50:09 GMT https://community.splunk.com/t5/Getting-Data-In/Windows-Server-2012-Splunkd-Service-Access-Denied/m-p/17873#M2387 UserFriendly 2013-02-03T08:50:09Z https://community.splunk.com/t5/Getting-Data-In/Windows-Server-2012-Splunkd-Service-Access-Denied/m-p/17874#M2388 <P>In case anyone else is encountering this issue: </P> <P>We fixed this in a kind of roundabout way. The Splunk server was a Server 2012 on a VMware VM. I had to go in and disable the hotplug ability on the guest. This allowed the services to run under a domain service account but for some reason it cut off all network access to the server. </P> <P>I then added a second NIC, booted up the VM and network connectivity was restored but the services failed again. After that I shutdown the machine, removed the new NIC and powered back on. For some reason network connectivity is restored and the splunk services are running under the domain account. I will update this entry as I find more information.</P> Tue, 05 Feb 2013 23:58:58 GMT https://community.splunk.com/t5/Getting-Data-In/Windows-Server-2012-Splunkd-Service-Access-Denied/m-p/17874#M2388 UserFriendly 2013-02-05T23:58:58Z