Domain Account for UF

jonwick — Thu, 08 Oct 2020 05:57:22 GMT

Hi Splunkers,

I'm realtively new with Splunk and trying to understand few aspects and need clarifications on below

In Which cases or Applications monitoring does UF needs domain account.

Does monitoring of Domain Controller server events needs domain Account?

Is the general approach to keep local account for UFs on servers unless it is explicitly needed?

What are roles are used for while installing UFs?

What is UF's username and password used for? Is it for security purpose so that anyone doesnt make any changes from CLI? Am I right?

Re: Domain Account for UF

gcusello — Thu, 08 Oct 2020 07:13:50 GMT

i @jonwick,

I usually install Universal Forwarder as a SYSTEM_LOCAL, but, as you can read at https://docs.splunk.com/Documentation/Forwarder/8.0.6/Forwarder/InstallaWindowsuniversalforwarderfromaninstaller#Choose_the_Windows_user_that_the_universal_forwarder_should_run_as , you can install it also as a Domain Account.

The reasons are:

Read Event Logs remotely
Collect performance counters remotely,
Read network shares for log files,
Access the Active Directory schema,
using Active Directory monitoring.

If you install as a domain user, you can choose whether or not the user has administrative privileges on the local machine. If you choose not to give the user administrative privileges, the universal forwarder enables "low-privilege" mode.

Ciao.

Giuseppe

topic Re: Domain Account for UF in Installation

Domain Account for UF

Re: Domain Account for UF