topic Re: Install UF via GPO in Getting Data In

How to install UF via GPO?

ask — Tue, 20 Jun 2023 13:54:30 GMT

Hi Team,

How to install UF via GPO?

Any specific command line to run the file .msi that use our username and password?

Thanks and best regards,

Re: Install UF via GPO

richgalloway — Wed, 05 May 2021 12:56:46 GMT

The UF installation guide doesn't address GPO, but still should be helpful. See https://docs.splunk.com/Documentation/Forwarder/8.1.3/Forwarder/InstallaWindowsuniversalforwarderremotelywithastaticconfiguration

Re: Install UF via GPO

ask — Thu, 06 May 2021 01:54:17 GMT

Thank you @richgalloway , appreciate on this 😊

Re: Install UF via GPO

DuncanClarke — Tue, 20 Jun 2023 12:32:57 GMT

I tried following the instructions linked but have failed to upgrade successfully.

I am upgrading from 9.0.4 to 9.0.5 using a (startup) script with one line:

MSIEXEC.exe /i splunkforwarder.msi AGREETOLICENSE="yes" DEPLOYMENT_SERVER="servername:port" SPLUNKUSERNAME="admin" SPLUNKPASSWORD="password" /QUIET

However, nothing happens when I reboot the server and it stays at 9.0.4. Running the command in an elevated CMD it doesn't appear to do anything either. If however I remove the /QUIET it then runs through the installation (interactively) without any issues and upgrades to 9.0.5.

Please can you advise if I'm missing something to allow it to run non-interactively using the /QUIET flag?

Re: Install UF via GPO

richgalloway — Tue, 20 Jun 2023 14:31:45 GMT

There's a note in latest version of the Forwarder Manual that may help https://docs.splunk.com/Documentation/Forwarder/latest/Forwarder/InstallaWindowsuniversalforwarderfromaninstaller#:~:text=If%20you%20have%20enabled%20Windows%20auto%20run%2C%20Splunk%20installation%20might%20be%20failed%20when%20the%20auto%20run%20script%20is%20failed.%20As%20a%20workaround%2C%20you%20can%20use%20cmd%20/D%20msiexec.exe%20/i%20to%20install%20Splunk.

If you have enabled Windows auto run, Splunk installation might be failed when the auto run script is failed. As a workaround, you can use cmd /D msiexec.exe /i to install Splunk.

Re: Install UF via GPO

DuncanClarke — Tue, 20 Jun 2023 16:22:57 GMT

For anyone else doing this, I have created a script which, when run as a startup script in a GPO, appears to work for us:

Computer Configuration -> Policies -> Windows Settings -> Scripts -> Startup

REM Get the folder from which it was called SET var=%~dp0 ECHO "%var%splunkforwarder.msi" REM Install the MSI MSIEXEC.exe /i "%var%splunkforwarder.msi" AGREETOLICENSE="yes" DEPLOYMENT_SERVER="server:port" SPLUNKUSERNAME="username" SPLUNKPASSWORD="password" /QN

If you run this script with the latest splunkforwarder.msi in the same directory it should install or update as appropriate.