https://community.splunk.com/t5/Getting-Data-In/Why-does-Splunk-service-startup-change-permissions-on-outputs/m-p/136293#M28077 <P>This is just a shot in the dark, but your Windows admins might have GPO doing something when services restart. </P> Wed, 10 Aug 2016 14:05:57 GMT lycollicott 2016-08-10T14:05:57Z https://community.splunk.com/t5/Getting-Data-In/Why-does-Splunk-service-startup-change-permissions-on-outputs/m-p/136292#M28076 <P>I am deploying new certificates to a number of UF's running on Windows Servers 2008 R2. This environment is restricted and I do not have admin rights on the server. Prior to the steps below I have full rights to the $SPLUNK_HOME directory and sub dirs.</P> <P>During this process I stop the Splunk Universal Forwarder service, rename the existing outputs.conf to outputs.old and copy a new outputs.conf from a network share, then restart the UF service (as well as copying new cert files). </P> <P>After starting splunk, the permissions (not file attributes) change from RW to Read only and I no longer have access to edit outputs.conf.</P> <P>Is this expected behaviour and can I stop this from happening? I realize I can edit the existing outputs.conf file vs replacing it, but I would like to stop splunk from setting permissions at all.</P> Thu, 04 Jun 2015 18:42:01 GMT https://community.splunk.com/t5/Getting-Data-In/Why-does-Splunk-service-startup-change-permissions-on-outputs/m-p/136292#M28076 rob_gibson 2015-06-04T18:42:01Z https://community.splunk.com/t5/Getting-Data-In/Why-does-Splunk-service-startup-change-permissions-on-outputs/m-p/136293#M28077 <P>This is just a shot in the dark, but your Windows admins might have GPO doing something when services restart. </P> Wed, 10 Aug 2016 14:05:57 GMT https://community.splunk.com/t5/Getting-Data-In/Why-does-Splunk-service-startup-change-permissions-on-outputs/m-p/136293#M28077 lycollicott 2016-08-10T14:05:57Z