Splunk app for Active Directory

[L3on1d]

Hello!

"Enable auditing and local PowerShell script execution on Active Directory servers"

Which scripts app runs on AD DC? How app will affect on the performance? Thanks.

[jbernt_splunk]

Typically, the TA for DNSServer and DomainController (in the Addons directory inside the Splunk for AD app folder $SPLUNK_HOME\etc\apps\Splunk_for_ActiveDirectory\appserver\addons\, will run the necessary PowerShell scripts for the inputs for each DNS and domain controller. The cpu may reach a few percent more when the PowerShell scripts are running due to the WMI calls they make, but you shouldn't notice much of a performance hit once the initial apps are deployed.
-Jeff.