All Apps and Add-ons
Highlighted

Should we install forwarders, indexers and search head as local system or domain account for Windows Infrastructure app?

Engager

If we intend to use the Splunk App for Windows Infrastructure to collect security-related logs (such as Logon/Logoff, GP changes, etc.), should we install the Forwarders, Indexers and Search Head as the Local System account or a domain account? The documentation is pretty clear that the Forwarders should be installed as Local System with no inputs enabled, but it's less clear about the other components.

0 Karma
Highlighted

Re: Should we install forwarders, indexers and search head as local system or domain account for Windows Infrastructure app?

Splunk Employee
Splunk Employee

Hi there. The forwarders and the account they run as are the only ones that really matter in this case. The Indexers and Search Heads can run on any supported OS, so the Local System account won't be available there anyway. You can run with a domain account, but we recommend Local System if possible unless there is a need to run as a domain user for least privilege.
Thanks!