Getting Data In

Can't determine universal forwarder service account

sdewar83
Path Finder

Hi,

I've inherited a poorly documented splunk deployment that seems to have been misconfigured. the universal forwarder service isnt starting on workstations due to a logon issue. Either the password is wrong or the account it is configured with is wrong.

Is there a way to determine what account is the correct account/which account the deployment server is expecting the UF to use?

Many thanks in advance.

Labels (1)
0 Karma

kappalkamal
New Member

Please check the owner of the file deploymentclient.conf which was essentially used to poll the server.
Please let me know what you found.

0 Karma
Get Updates on the Splunk Community!

Developer Spotlight with Brett Adams

In our third Spotlight feature, we're excited to shine a light on Brett—a Splunk consultant, innovative ...

Index This | What can you do to make 55,555 equal 500?

April 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Say goodbye to manually analyzing phishing and malware threats with Splunk Attack ...

In today’s evolving threat landscape, we understand you’re constantly bombarded with phishing and malware ...