Deployment Architecture

How to assign a password to the Universal Forwarder to prevent it from being uninstalled?

edgarsilva01
Path Finder

Hello everyone,

Is there a way to assign a password to the universal forwarder to prevent it from being uninstalled?

or what options do i have?

Thanks

Regards

Labels (1)
0 Karma

lloydknight
Builder

Hello @edgarsilva01

I believe the question is more on user's operating system rights/permission to modify the UF.

As the admin or root user has all the rights to uninstall/delete a UF in most cases, you may need to set a governance should the said user be assigned as admin/root or not.

Linux:
Best practice on UF installation is to not install it as root. Try to set a splunk:splunk (user:group) for this and set permissions for this splunk-specific user:group.

https://docs.splunk.com/Documentation/Splunk/8.0.3/Installation/RunSplunkasadifferentornon-rootuser

Windows:
Though I'm not very particular on Windows installations but UF is installed as Admin in most cases. Then from here, user rights can be managed on AD.

Should the UF was installed on a non-admin user, the forwarder installs and runs in "low-privilege" mode.

https://docs.splunk.com/Documentation/Forwarder/8.0.3/Forwarder/InstallaWindowsuniversalforwarderfro...

Hope it helps!

Get Updates on the Splunk Community!

.conf25 Community Recap

Hello Splunkers, And just like that, .conf25 is in the books! What an incredible few days — full of learning, ...

Splunk App Developers | .conf25 Recap & What’s Next

If you stopped by the Builder Bar at .conf25 this year, thank you! The retro tech beer garden vibes were ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...