Building for the Splunk Platform

How can i monitor Active Directory with splunk enterprise install Local System?

New Member


I found this document ( is require "Splunk Enterprise must run as a domain user".
But I installed splunk enterprise with user "Local System" not "Domain Account".
I should uninstall splunk enterprise and install with user "Domain Account"?


Tags (1)
0 Karma

0 Karma

New Member

If i want to monitor:
- Read Event Logs remotely
- Collect performance counters remotely
- Read network shares for log files
- Access the Active Directory schema, using Active Directory monitoring

It's mean i don't need to reinstall splunk enterprise. I just install universal forwarder by use domain account right?


0 Karma
Get Updates on the Splunk Community!

Security Highlights | November 2022 Newsletter

 November 2022 2022 Gartner Magic Quadrant for SIEM: Splunk Named a Leader for the 9th Year in a RowSplunk is ...

Platform Highlights | November 2022 Newsletter

 November 2022 Skill Up on Splunk with our New Builder Tech Talk SeriesCan you build it? Yes you can! *play ...

Splunk Education - Fast Start Program!

Welcome to Splunk Education! Splunk training programs are designed to enable you to get started quickly and ...