Getting Data In

AD with multiple Domain controllers monitoring using Splunk

gethelog
New Member

I want to monitor multiple Domain controllers using a universal forwarder installed on a separate windows server which is running under a user account that has "Admin Read only" credentials to the whole site. Is that possible? When I set that up and test, I only see AD events for the nearest DC. I don't see any events from the others. But when I install the universal forwarder on the other DCs themselves I get AD events from them. It seems it is only giving me events from one domain controller. Any ideas on how I can make this possible? If I can I don't want to have a universal forwarder on each of the domain controllers.

Tags (1)
0 Karma
1 Solution

ahall_splunk
Splunk Employee
Splunk Employee

admon will bind to one domain controller. You can set that to be a specific domain controller or the "closest" one. You can set up multiple universal forwarders (even on the same machine) and run different configs that read from different hosts.

Aside from that, you will also want to watch the Windows Security event log from each domain controller. This can be done via WMI or a locally installed UF. I'd recommend the latter as WMI is single-threaded for reading windows event logs and will cause missed events and slow retrieval in a busy environment.

View solution in original post

0 Karma

gethelog
New Member

I had "targetDC" in my configurations instead of "targetDc". I guess that was making Splunk to use the default, which is use the nearest DC. I read somewhere in the documentation that the change from "targetDC" to "targetDc" was made on the 4.3 version. Even though the documentation says "Note that making this change does not affect how Active Directory monitoring works.", in my opinion it does affect how the AD monitoring works.

0 Karma

ahall_splunk
Splunk Employee
Splunk Employee

admon will bind to one domain controller. You can set that to be a specific domain controller or the "closest" one. You can set up multiple universal forwarders (even on the same machine) and run different configs that read from different hosts.

Aside from that, you will also want to watch the Windows Security event log from each domain controller. This can be done via WMI or a locally installed UF. I'd recommend the latter as WMI is single-threaded for reading windows event logs and will cause missed events and slow retrieval in a busy environment.

0 Karma

tonopahtaos
Path Finder

This is wrong. admon can be configured to get events from multiple domain controllers. For more info, please see:

http://docs.splunk.com/Documentation/Splunk/latest/Data/AuditActiveDirectory

Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...