So I skimmed this so slap me if I'm jumping to conclusion too fast. I think this is a fair confusion that we often have but I'll try to break it down.
The TA is needed on the SH so the sourcetype definitions can be used - as in, so you can enjoy fields and event breaking fun. The TA is needed on the indexers (or a HF if the data goes there first) to make sure that same sourcetype magic can handle the event breaking (timestamp, line breaking, etc...) fun that happens at index time.
In both situations, you might be putting such TA on indexers or search heads that are Linux, not Windows OS. Yup, that seems wrong but it's correct because we're not using the TA there for data collection, but for data definition (sourcetype). So, in that scenario, you prob have the inputs off.
Of course, if you have Windows hosts, you'd want the TA deployed but for data collection purposes, not sourcetype funsies.
Now for the kicker: you shouldn't have a problem putting that same TA, with the inputs configured enabled, in all three of these places (SH, Ind, Forwarders) even if the SH and IDX are not Windows. That's because when the Windows specific inputs try to run on a Linux system, they will fail once and not attempt again until that Splunk instance is restarted. That's a nice safety net to help situations just like this.
