Getting Data In

AD with multiple Domain controllers monitoring using Splunk

gethelog
New Member

I want to monitor multiple Domain controllers using a universal forwarder installed on a separate windows server which is running under a user account that has "Admin Read only" credentials to the whole site. Is that possible? When I set that up and test, I only see AD events for the nearest DC. I don't see any events from the others. But when I install the universal forwarder on the other DCs themselves I get AD events from them. It seems it is only giving me events from one domain controller. Any ideas on how I can make this possible? If I can I don't want to have a universal forwarder on each of the domain controllers.

Tags (1)
0 Karma
1 Solution

ahall_splunk
Splunk Employee
Splunk Employee

admon will bind to one domain controller. You can set that to be a specific domain controller or the "closest" one. You can set up multiple universal forwarders (even on the same machine) and run different configs that read from different hosts.

Aside from that, you will also want to watch the Windows Security event log from each domain controller. This can be done via WMI or a locally installed UF. I'd recommend the latter as WMI is single-threaded for reading windows event logs and will cause missed events and slow retrieval in a busy environment.

View solution in original post

0 Karma

gethelog
New Member

I had "targetDC" in my configurations instead of "targetDc". I guess that was making Splunk to use the default, which is use the nearest DC. I read somewhere in the documentation that the change from "targetDC" to "targetDc" was made on the 4.3 version. Even though the documentation says "Note that making this change does not affect how Active Directory monitoring works.", in my opinion it does affect how the AD monitoring works.

0 Karma

ahall_splunk
Splunk Employee
Splunk Employee

admon will bind to one domain controller. You can set that to be a specific domain controller or the "closest" one. You can set up multiple universal forwarders (even on the same machine) and run different configs that read from different hosts.

Aside from that, you will also want to watch the Windows Security event log from each domain controller. This can be done via WMI or a locally installed UF. I'd recommend the latter as WMI is single-threaded for reading windows event logs and will cause missed events and slow retrieval in a busy environment.

0 Karma

tonopahtaos
Path Finder

This is wrong. admon can be configured to get events from multiple domain controllers. For more info, please see:

http://docs.splunk.com/Documentation/Splunk/latest/Data/AuditActiveDirectory

Get Updates on the Splunk Community!

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...