Deployment Architecture

How to assign a password to the Universal Forwarder to prevent it from being uninstalled?

edgarsilva01
Path Finder

Hello everyone,

Is there a way to assign a password to the universal forwarder to prevent it from being uninstalled?

or what options do i have?

Thanks

Regards

Labels (1)
0 Karma

lloydknight
Builder

Hello @edgarsilva01

I believe the question is more on user's operating system rights/permission to modify the UF.

As the admin or root user has all the rights to uninstall/delete a UF in most cases, you may need to set a governance should the said user be assigned as admin/root or not.

Linux:
Best practice on UF installation is to not install it as root. Try to set a splunk:splunk (user:group) for this and set permissions for this splunk-specific user:group.

https://docs.splunk.com/Documentation/Splunk/8.0.3/Installation/RunSplunkasadifferentornon-rootuser

Windows:
Though I'm not very particular on Windows installations but UF is installed as Admin in most cases. Then from here, user rights can be managed on AD.

Should the UF was installed on a non-admin user, the forwarder installs and runs in "low-privilege" mode.

https://docs.splunk.com/Documentation/Forwarder/8.0.3/Forwarder/InstallaWindowsuniversalforwarderfro...

Hope it helps!

Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Level Up Your .conf25: Splunk Arcade Comes to Boston

With .conf25 right around the corner in Boston, there’s a lot to look forward to — inspiring keynotes, ...

Manual Instrumentation with Splunk Observability Cloud: How to Instrument Frontend ...

Although it might seem daunting, as we’ve seen in this series, manual instrumentation can be straightforward ...

Take Action Automatically on Splunk Alerts with Red Hat Ansible Automation Platform

Ready to make your IT operations smarter and more efficient? Discover how to automate Splunk alerts with Red ...