Agentless event gathering on Win2008

New Member

I've worked with the WMI agentless event gathering for Splunk in older versions of Windows, but it looks like Win2008 R2 has moved to the new facility of WinRM. Can Splunk collect Win2008 R2 events via WinRM?

0 Karma

Splunk Employee
Splunk Employee

There are no issues in using WMI with Windows 2008 R2. Here is a full article on how to configure WMi support -- as well as permissions, rights, and other considerations:

One thing to keep in mind when using W2K8 R2 is that Windows Firewall is enabled by default. In order to allow WMI, you need to add a rule:

netsh firewall set service RemoteAdmin enable