I'm getting GetDriverHandle: Unable to install driver. Errors...

[Genti]

"Hi support
I am receiving a lot of these messages in my light forwarder's splunkd.log
06-29-2010 14:27:05.615 ERROR ExecProcessor - message from ""C:\Program Files\Splunk\bin\splunk-regmon.exe" --driver-path "C:\Program Files\Splunk\bin"" splunk-regmon - GetDriverHandle: Unable to install driver.

Why is this happening and how do i remove them?"

[Genti · Accepted solution]

So the issue of the driver signature has come up before.
Im not too sure why it happens but one possibility is with 64bit machines and the driver not passing the signing. Another possibility is if you already have one instance of splunk running and the regmon is already being monitored.

Since this is a light forwarder then you cannot use splunkweb to disable the monitoring. What is needed is to change this in the configuration files: Go to C:\Program Files\Splunk\etc\system\local\inputs.conf

And add this:

[script://$SPLUNK_HOME\bin\scripts\splunk-regmon.path]
disabled = 1

Once done, a splunk restart is all that is needed.
Cheers
.gz