Getting Data In

AD with multiple Domain controllers monitoring using Splunk

gethelog
New Member

I want to monitor multiple Domain controllers using a universal forwarder installed on a separate windows server which is running under a user account that has "Admin Read only" credentials to the whole site. Is that possible? When I set that up and test, I only see AD events for the nearest DC. I don't see any events from the others. But when I install the universal forwarder on the other DCs themselves I get AD events from them. It seems it is only giving me events from one domain controller. Any ideas on how I can make this possible? If I can I don't want to have a universal forwarder on each of the domain controllers.

Tags (1)
0 Karma
1 Solution

ahall_splunk
Splunk Employee
Splunk Employee

admon will bind to one domain controller. You can set that to be a specific domain controller or the "closest" one. You can set up multiple universal forwarders (even on the same machine) and run different configs that read from different hosts.

Aside from that, you will also want to watch the Windows Security event log from each domain controller. This can be done via WMI or a locally installed UF. I'd recommend the latter as WMI is single-threaded for reading windows event logs and will cause missed events and slow retrieval in a busy environment.

View solution in original post

0 Karma

gethelog
New Member

I had "targetDC" in my configurations instead of "targetDc". I guess that was making Splunk to use the default, which is use the nearest DC. I read somewhere in the documentation that the change from "targetDC" to "targetDc" was made on the 4.3 version. Even though the documentation says "Note that making this change does not affect how Active Directory monitoring works.", in my opinion it does affect how the AD monitoring works.

0 Karma

ahall_splunk
Splunk Employee
Splunk Employee

admon will bind to one domain controller. You can set that to be a specific domain controller or the "closest" one. You can set up multiple universal forwarders (even on the same machine) and run different configs that read from different hosts.

Aside from that, you will also want to watch the Windows Security event log from each domain controller. This can be done via WMI or a locally installed UF. I'd recommend the latter as WMI is single-threaded for reading windows event logs and will cause missed events and slow retrieval in a busy environment.

0 Karma

tonopahtaos
Path Finder

This is wrong. admon can be configured to get events from multiple domain controllers. For more info, please see:

http://docs.splunk.com/Documentation/Splunk/latest/Data/AuditActiveDirectory

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...