AD with multiple Domain controllers monitoring using Splunk

[gethelog]

I want to monitor multiple Domain controllers using a universal forwarder installed on a separate windows server which is running under a user account that has "Admin Read only" credentials to the whole site. Is that possible? When I set that up and test, I only see AD events for the nearest DC. I don't see any events from the others. But when I install the universal forwarder on the other DCs themselves I get AD events from them. It seems it is only giving me events from one domain controller. Any ideas on how I can make this possible? If I can I don't want to have a universal forwarder on each of the domain controllers.

[gethelog]

I had "targetDC" in my configurations instead of "targetDc". I guess that was making Splunk to use the default, which is use the nearest DC. I read somewhere in the documentation that the change from "targetDC" to "targetDc" was made on the 4.3 version. Even though the documentation says "Note that making this change does not affect how Active Directory monitoring works.", in my opinion it does affect how the AD monitoring works.

[ahall_splunk · Accepted solution]

admon will bind to one domain controller. You can set that to be a specific domain controller or the "closest" one. You can set up multiple universal forwarders (even on the same machine) and run different configs that read from different hosts.

Aside from that, you will also want to watch the Windows Security event log from each domain controller. This can be done via WMI or a locally installed UF. I'd recommend the latter as WMI is single-threaded for reading windows event logs and will cause missed events and slow retrieval in a busy environment.

[tonopahtaos]

This is wrong. admon can be configured to get events from multiple domain controllers. For more info, please see:

http://docs.splunk.com/Documentation/Splunk/latest/Data/AuditActiveDirectory