How to assign a password to the Universal Forwarder to prevent it from being uninstalled?

[edgarsilva01]

Hello everyone,

Is there a way to assign a password to the universal forwarder to prevent it from being uninstalled?

or what options do i have?

Thanks

Regards

[lloydknight]

Hello @edgarsilva01

I believe the question is more on user's operating system rights/permission to modify the UF.

As the admin or root user has all the rights to uninstall/delete a UF in most cases, you may need to set a governance should the said user be assigned as admin/root or not.

Linux:
Best practice on UF installation is to not install it as root. Try to set a splunk:splunk (user:group) for this and set permissions for this splunk-specific user:group.

https://docs.splunk.com/Documentation/Splunk/8.0.3/Installation/RunSplunkasadifferentornon-rootuser

Windows:
Though I'm not very particular on Windows installations but UF is installed as Admin in most cases. Then from here, user rights can be managed on AD.

Should the UF was installed on a non-admin user, the forwarder installs and runs in "low-privilege" mode.

https://docs.splunk.com/Documentation/Forwarder/8.0.3/Forwarder/InstallaWindowsuniversalforwarderfro...

Hope it helps!