https://community.splunk.com/t5/Getting-Data-In/Can-t-determine-universal-forwarder-service-account/m-p/465464#M80247 <P>Hi,</P> <P>I've inherited a poorly documented splunk deployment that seems to have been misconfigured. the universal forwarder service isnt starting on workstations due to a logon issue. Either the password is wrong or the account it is configured with is wrong.</P> <P>Is there a way to determine what account is the correct account/which account the deployment server is expecting the UF to use?</P> <P>Many thanks in advance.</P> Sun, 07 Jun 2020 01:25:45 GMT sdewar83 2020-06-07T01:25:45Z https://community.splunk.com/t5/Getting-Data-In/Can-t-determine-universal-forwarder-service-account/m-p/465464#M80247 <P>Hi,</P> <P>I've inherited a poorly documented splunk deployment that seems to have been misconfigured. the universal forwarder service isnt starting on workstations due to a logon issue. Either the password is wrong or the account it is configured with is wrong.</P> <P>Is there a way to determine what account is the correct account/which account the deployment server is expecting the UF to use?</P> <P>Many thanks in advance.</P> Sun, 07 Jun 2020 01:25:45 GMT https://community.splunk.com/t5/Getting-Data-In/Can-t-determine-universal-forwarder-service-account/m-p/465464#M80247 sdewar83 2020-06-07T01:25:45Z https://community.splunk.com/t5/Getting-Data-In/Can-t-determine-universal-forwarder-service-account/m-p/465465#M80248 <P>Please check the owner of the file deploymentclient.conf which was essentially used to poll the server. <BR /> Please let me know what you found.</P> Wed, 27 May 2020 03:00:17 GMT https://community.splunk.com/t5/Getting-Data-In/Can-t-determine-universal-forwarder-service-account/m-p/465465#M80248 kappalkamal 2020-05-27T03:00:17Z