https://community.splunk.com/t5/Getting-Data-In/Can-you-help-me-with-my-Splunk-Universal-Forwarder-starting/m-p/397515#M70865 <P>Always you need to run service with administrator account and cmd prompt Without admin rights you can't run services, If you don't have admin rights you need to ask user to start the services who have admin rights.</P> Mon, 26 Nov 2018 11:41:15 GMT sahiltcs 2018-11-26T11:41:15Z https://community.splunk.com/t5/Getting-Data-In/Can-you-help-me-with-my-Splunk-Universal-Forwarder-starting/m-p/397513#M70863 <P>Hello. I am troubleshooting a universal forwarder installed on a Windows system. I noticed that the SplunkForwarder service only starts if the "Log On As" user for the service has administrator rights on the system. How can I grant permissions to start the service without it needing admin rights on the system?</P> Tue, 20 Nov 2018 16:15:41 GMT https://community.splunk.com/t5/Getting-Data-In/Can-you-help-me-with-my-Splunk-Universal-Forwarder-starting/m-p/397513#M70863 johann2017 2018-11-20T16:15:41Z https://community.splunk.com/t5/Getting-Data-In/Can-you-help-me-with-my-Splunk-Universal-Forwarder-starting/m-p/397514#M70864 <P>Are you running as a specific user, or as the Local System Account? Generally speaking, I believe it should use the Local System Account.<BR /> Another note, I have always tried starting the service from an Administrator cmd prompt. Not from the Services window.</P> Tue, 20 Nov 2018 19:03:12 GMT https://community.splunk.com/t5/Getting-Data-In/Can-you-help-me-with-my-Splunk-Universal-Forwarder-starting/m-p/397514#M70864 joebisesi 2018-11-20T19:03:12Z https://community.splunk.com/t5/Getting-Data-In/Can-you-help-me-with-my-Splunk-Universal-Forwarder-starting/m-p/397515#M70865 <P>Always you need to run service with administrator account and cmd prompt Without admin rights you can't run services, If you don't have admin rights you need to ask user to start the services who have admin rights.</P> Mon, 26 Nov 2018 11:41:15 GMT https://community.splunk.com/t5/Getting-Data-In/Can-you-help-me-with-my-Splunk-Universal-Forwarder-starting/m-p/397515#M70865 sahiltcs 2018-11-26T11:41:15Z https://community.splunk.com/t5/Getting-Data-In/Can-you-help-me-with-my-Splunk-Universal-Forwarder-starting/m-p/397516#M70866 <P>On all of our systems that have the UF installed, they are running as Local System Account. They do not and should not be run using the Administrator Account. </P> Mon, 26 Nov 2018 12:00:46 GMT https://community.splunk.com/t5/Getting-Data-In/Can-you-help-me-with-my-Splunk-Universal-Forwarder-starting/m-p/397516#M70866 joebisesi 2018-11-26T12:00:46Z https://community.splunk.com/t5/Getting-Data-In/Can-you-help-me-with-my-Splunk-Universal-Forwarder-starting/m-p/397517#M70867 <P>Agree with your comments but if we have Universal forwarder installed on another system and we don't have permissions to start the services then we need to ask user to start the services who have admin rights.</P> Mon, 26 Nov 2018 12:04:05 GMT https://community.splunk.com/t5/Getting-Data-In/Can-you-help-me-with-my-Splunk-Universal-Forwarder-starting/m-p/397517#M70867 sahiltcs 2018-11-26T12:04:05Z https://community.splunk.com/t5/Getting-Data-In/Can-you-help-me-with-my-Splunk-Universal-Forwarder-starting/m-p/397518#M70868 <P>The main question is: how did you install the UF? If it was installed using a privileged account and you are now trying to start it with a non-privileged account, it will probably fail, as that account does not have the required permissions on the install dir.</P> <P>It is possible to run Splunk under a non-admin user, but then it also needs to be installed as such I think (or you need to manually update the permissions on the Splunk install dir such that the account you want to use has access to that).</P> <P>See also: <A href="http://docs.splunk.com/Documentation/Forwarder/7.2.1/Forwarder/InstallaWindowsuniversalforwarderfromaninstaller#Install_the_universal_forwarder_in_.22low-privilege.22_mode">http://docs.splunk.com/Documentation/Forwarder/7.2.1/Forwarder/InstallaWindowsuniversalforwarderfromaninstaller#Install_the_universal_forwarder_in_.22low-privilege.22_mode</A></P> Mon, 26 Nov 2018 12:54:38 GMT https://community.splunk.com/t5/Getting-Data-In/Can-you-help-me-with-my-Splunk-Universal-Forwarder-starting/m-p/397518#M70868 FrankVl 2018-11-26T12:54:38Z