Getting Data In

AD with multiple Domain controllers monitoring using Splunk

gethelog
New Member

I want to monitor multiple Domain controllers using a universal forwarder installed on a separate windows server which is running under a user account that has "Admin Read only" credentials to the whole site. Is that possible? When I set that up and test, I only see AD events for the nearest DC. I don't see any events from the others. But when I install the universal forwarder on the other DCs themselves I get AD events from them. It seems it is only giving me events from one domain controller. Any ideas on how I can make this possible? If I can I don't want to have a universal forwarder on each of the domain controllers.

Tags (1)
0 Karma
1 Solution

ahall_splunk
Splunk Employee
Splunk Employee

admon will bind to one domain controller. You can set that to be a specific domain controller or the "closest" one. You can set up multiple universal forwarders (even on the same machine) and run different configs that read from different hosts.

Aside from that, you will also want to watch the Windows Security event log from each domain controller. This can be done via WMI or a locally installed UF. I'd recommend the latter as WMI is single-threaded for reading windows event logs and will cause missed events and slow retrieval in a busy environment.

View solution in original post

0 Karma

gethelog
New Member

I had "targetDC" in my configurations instead of "targetDc". I guess that was making Splunk to use the default, which is use the nearest DC. I read somewhere in the documentation that the change from "targetDC" to "targetDc" was made on the 4.3 version. Even though the documentation says "Note that making this change does not affect how Active Directory monitoring works.", in my opinion it does affect how the AD monitoring works.

0 Karma

ahall_splunk
Splunk Employee
Splunk Employee

admon will bind to one domain controller. You can set that to be a specific domain controller or the "closest" one. You can set up multiple universal forwarders (even on the same machine) and run different configs that read from different hosts.

Aside from that, you will also want to watch the Windows Security event log from each domain controller. This can be done via WMI or a locally installed UF. I'd recommend the latter as WMI is single-threaded for reading windows event logs and will cause missed events and slow retrieval in a busy environment.

0 Karma

tonopahtaos
Path Finder

This is wrong. admon can be configured to get events from multiple domain controllers. For more info, please see:

http://docs.splunk.com/Documentation/Splunk/latest/Data/AuditActiveDirectory

Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

March Community Office Hours Security Series Uncovered!

Hello Splunk Community! In March, Splunk Community Office Hours spotlighted our fabulous Splunk Threat ...

Stay Connected: Your Guide to April Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars in April. This post ...