Archive

How can i monitor Active Directory with splunk enterprise install Local System?

mindterrian
New Member

Hi

I found this document (https://docs.splunk.com/Documentation/Splunk/7.2.3/Data/MonitorActiveDirectory) is require "Splunk Enterprise must run as a domain user".
But I installed splunk enterprise with user "Local System" not "Domain Account".
I should uninstall splunk enterprise and install with user "Domain Account"?

Thanks

Tags (1)
0 Karma

dkeck
Influencer
0 Karma

mindterrian
New Member

If i want to monitor:
- Read Event Logs remotely
- Collect performance counters remotely
- Read network shares for log files
- Access the Active Directory schema, using Active Directory monitoring

It's mean i don't need to reinstall splunk enterprise. I just install universal forwarder by use domain account right?

Thanks

0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!