All Apps and Add-ons

Local Admin

stharathi
Engager

Hi,

If a user is added as local admin and also local admin group. What's the difference and is there any security risk?

Regards,

Shashank

Labels (1)

gcusello
SplunkTrust
SplunkTrust

Hi @stharathi,

as @inventsekar said, your question isn't clear:

are you speaking of windows administrators or Splunk administrators?

if Windows, this isn't the right site to put this question;

if Splunk, in Splunk there's one level of administration by default, if you create different levels of administrators it's a your customization.

So if you want our opinion about creating two levels of administrators, the only answer can be: it depends on your architecture and organization.

In other words, you can create one or more administrators groups that manage only a part of infrastructure (e.g. one site each one), and a super admininstrator that manage all the infrastructure, but, as I said, it depends on your infrastructure and organization and it isn't possible to give an opinion without knowing them.

Generally I can say that, if you have a large infrastructure, it could be a good idea delegating part of administration to a second level administrators, but it gives to your organization more difficoulties in management and design of roles and grants.

Ciao.

Giuseppe

inventsekar
SplunkTrust
SplunkTrust

not sure i understand your question... can you please elaborate, Shashank @stharathi 

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Agentic SOC Triage: Investigating Splunk ES Notables with MCP Server and a Local LLM

The Problem: Too Many Alerts, Too Little Context Security operations teams running Splunk Enterprise Security ...

All Work and No Play? Not at .conf26! Unwind at These Evening Events

Between hands-on technical sessions, keynote reveals, and diving into live architectures, .conf26 is packed ...

Join the Hackathon at .conf26 and build a No-Code AI agent

Join us for the AI Agent Buildathon, an in-person, three-hour hands-on Hackathon where you’ll use Splunk Agent ...