topic Re: Universal Forwarder Permissions in Installation https://community.splunk.com/t5/Installation/Universal-Forwarder-Permissions/m-p/681107#M13745 <P>There are docs like <A href="https://docs.splunk.com/Documentation/Forwarder/9.2.0/Forwarder/Installleastprivileged" target="_blank">https://docs.splunk.com/Documentation/Forwarder/9.2.0/Forwarder/Installleastprivileged</A></P><P>Also the recent versions of Windows UF create a user with a relatively limited set of permissions.</P><P>But</P><P>It's a setup for a limited set of permissions for a typical use case. And as a fairly generic setup it can be both too "closed" (for example, you need a domain user with proper perrmisions to read remote shares) as well as too "open" (you don't need access to Event Log if you're not planning to read from it.</P> Mon, 18 Mar 2024 22:45:31 GMT PickleRick 2024-03-18T22:45:31Z Universal Forwarder Permissions https://community.splunk.com/t5/Installation/Universal-Forwarder-Permissions/m-p/681103#M13744 <P>Is there a specific set of permissions for splunk universal forwarders and its user account? Maybe a document that points to this?</P> Mon, 18 Mar 2024 21:44:44 GMT https://community.splunk.com/t5/Installation/Universal-Forwarder-Permissions/m-p/681103#M13744 Nap 2024-03-18T21:44:44Z Re: Universal Forwarder Permissions https://community.splunk.com/t5/Installation/Universal-Forwarder-Permissions/m-p/681107#M13745 <P>There are docs like <A href="https://docs.splunk.com/Documentation/Forwarder/9.2.0/Forwarder/Installleastprivileged" target="_blank">https://docs.splunk.com/Documentation/Forwarder/9.2.0/Forwarder/Installleastprivileged</A></P><P>Also the recent versions of Windows UF create a user with a relatively limited set of permissions.</P><P>But</P><P>It's a setup for a limited set of permissions for a typical use case. And as a fairly generic setup it can be both too "closed" (for example, you need a domain user with proper perrmisions to read remote shares) as well as too "open" (you don't need access to Event Log if you're not planning to read from it.</P> Mon, 18 Mar 2024 22:45:31 GMT https://community.splunk.com/t5/Installation/Universal-Forwarder-Permissions/m-p/681107#M13745 PickleRick 2024-03-18T22:45:31Z