topic Re: How to debug evt_resolve_ad_obj on a universal forwarder? in Getting Data In

How to debug evt_resolve_ad_obj on a universal forwarder?

Ed_Alias — Tue, 29 Sep 2020 06:36:27 GMT

Hi,

I am trying to debug evt_resolve_ad_obj not working properly?

How do I enable debug to see wich Domain Controller is being contacted, and see the answer from the DC?

i am on UF 6.2.3 on windows server 2008R2.

Re: How to debug evt_resolve_ad_obj on a universal forwarder?

woodcock — Wed, 30 Sep 2015 16:29:10 GMT

According to the dox here:

http://docs.splunk.com/Documentation/Splunk/6.3.0/Data/Monitorwindowsdata

If you discover that Splunk is not translating SIDs properly, review splunkd.log for clues on what the problem might be.

Re: How to debug evt_resolve_ad_obj on a universal forwarder?

dstaulcu — Tue, 29 Sep 2020 07:28:19 GMT

Hello

For the fact that you are checking on the DC used by a UF, I suspect you have stumbled across a bug I struggled with for a while..

Somewhere between version 6.0 and 6.0.3, a bug was introduced causing the universal to communicate with the PDC of your domain (instead of nearest DC) regardless of whether evt_resolve_ad_obj was enabled or disabled for each wineventlog based input. I submitted an SPL for this issue and the issue was corrected in version 6.3.0.

http://answers.splunk.com/answers/171507/universal-forwarder-wineventlog-handler-affinity-f.html