Can't determine universal forwarder service account

[sdewar83]

Hi,

I've inherited a poorly documented splunk deployment that seems to have been misconfigured. the universal forwarder service isnt starting on workstations due to a logon issue. Either the password is wrong or the account it is configured with is wrong.

Is there a way to determine what account is the correct account/which account the deployment server is expecting the UF to use?

Many thanks in advance.

[kappalkamal]

Please check the owner of the file deploymentclient.conf which was essentially used to poll the server.
Please let me know what you found.