https://community.splunk.com/t5/Getting-Data-In/Does-the-Windows-Active-Directory-user-for-Splunk-forwarder-need/m-p/373622#M67708 <P>No, you would not need Remote Desktop access for that user.</P> Thu, 11 May 2017 14:28:35 GMT kmorris_splunk 2017-05-11T14:28:35Z https://community.splunk.com/t5/Getting-Data-In/Does-the-Windows-Active-Directory-user-for-Splunk-forwarder-need/m-p/373619#M67705 <P>Hello,</P> <P>Does the Windows user for Splunk forwarder need "Remote Desktop access" rights?</P> <P>In general, what kind of Windows user/role/rights is recommended?</P> <P>Thanks.</P> Thu, 11 May 2017 10:27:05 GMT https://community.splunk.com/t5/Getting-Data-In/Does-the-Windows-Active-Directory-user-for-Splunk-forwarder-need/m-p/373619#M67705 splunkreal 2017-05-11T10:27:05Z https://community.splunk.com/t5/Getting-Data-In/Does-the-Windows-Active-Directory-user-for-Splunk-forwarder-need/m-p/373620#M67706 <P>Take a look here (excerpt on choosing the Windows user below):<BR /> <A href="https://docs.splunk.com/Documentation/Forwarder/6.5.3/Forwarder/InstallaWindowsuniversalforwarderfromaninstaller">https://docs.splunk.com/Documentation/Forwarder/6.5.3/Forwarder/InstallaWindowsuniversalforwarderfromaninstaller</A></P> <P><STRONG>Choose the Windows user that the universal forwarder should run as</STRONG><BR /> When you install the universal forwarder, you can select the Windows user that the forwarder uses to get data. You have two choices.</P> <P>Local System. If you specify the Local System user during the installation process, the universal forwarder collects any kind of data that is available on the local host. It cannot collect data from other hosts.<BR /> Domain account. This option installs the forwarder as the Windows user you specify. The forwarder has the permissions that have been assigned to that user, and collects data that the user has read access to. It does not collect data from resources that the Windows user does not have access to. If you need to collect data from those resources, you must give the Windows user access to those resources.<BR /> Install the forwarder as a Domain account to do any of the following:</P> <P>Read Event Logs remotely<BR /> Collect performance counters remotely<BR /> Read network shares for log files<BR /> Access the Active Directory schema, using Active Directory monitoring<BR /> Choose and configure the user that the universal forwarder should run as before installing the forwarder for remote Windows data collection. If you do not, installation can fail.</P> <P>If you install as a domain user, specify a user that has access to the data you want to monitor. See Choose the Windows user Splunk should run as in the Splunk Enterprise Installation Manual for concepts and procedures on the user requirements that must be in place before you collect remote Windows data.</P> <P>If you install as a domain user, you can choose whether or not the user has administrative privileges on the local machine. If you choose not to give the user administrative privileges, the universal forwarder enables "low-privilege" mode. See Install the universal forwarder in low-privilege mode.</P> Thu, 11 May 2017 11:49:37 GMT https://community.splunk.com/t5/Getting-Data-In/Does-the-Windows-Active-Directory-user-for-Splunk-forwarder-need/m-p/373620#M67706 kmorris_splunk 2017-05-11T11:49:37Z https://community.splunk.com/t5/Getting-Data-In/Does-the-Windows-Active-Directory-user-for-Splunk-forwarder-need/m-p/373621#M67707 <P>Thanks kmorris, could you confirm Remote Desktop access is not required then as we only index local files/registry?</P> Thu, 11 May 2017 12:09:30 GMT https://community.splunk.com/t5/Getting-Data-In/Does-the-Windows-Active-Directory-user-for-Splunk-forwarder-need/m-p/373621#M67707 splunkreal 2017-05-11T12:09:30Z https://community.splunk.com/t5/Getting-Data-In/Does-the-Windows-Active-Directory-user-for-Splunk-forwarder-need/m-p/373622#M67708 <P>No, you would not need Remote Desktop access for that user.</P> Thu, 11 May 2017 14:28:35 GMT https://community.splunk.com/t5/Getting-Data-In/Does-the-Windows-Active-Directory-user-for-Splunk-forwarder-need/m-p/373622#M67708 kmorris_splunk 2017-05-11T14:28:35Z