Is it possible to install the Splunk Support for Active Directory add-on on the Domain Controller with a universal forwarder?

[nikkkc]

Hi,

Is it possible or does it make sense to install the Splunk Support for Active Directory add-on on the domain controller with the universal forwarder?
The topology is as follows: Domain Controller with universal Forwarder ---> WAN -->> Heavy Forwarder DMZ ---> Indexer LAN.

The problem is there is no VPN form Indexer to the Domain Controller. I have to use the ssl/tls encryption, but I am not allowed to change any firewall settings. My Problem is how can sa-ldapserach authenticate to the DC?

Any Ideas? How could we design this?
thanks

[jkat54]

Best you can do is install a heavy forwarder on the domain controller:

http://docs.splunk.com/Documentation/SA-LdapSearch/latest/User/Platformandhardwarerequirements#Distr...

But then you'll have to configure your searches on the domain controller itself and maybe send data into summary indexes in the indexer cluster.

What is it you're hoping to get from the add on? Are you using it for the built in commands?