I see you can enable/disable a light forwarder via the gui or cli, but can't seem to dig up the conf file that contains this. Is it possible to push a conf file change and restart splunk to accomplish this?
Hmm...appears it may be these two files:
state = disabled
state = enabled