Can you help me with my Splunk Universal Forwarder starting problem?

[johann2017]

Hello. I am troubleshooting a universal forwarder installed on a Windows system. I noticed that the SplunkForwarder service only starts if the "Log On As" user for the service has administrator rights on the system. How can I grant permissions to start the service without it needing admin rights on the system?

[FrankVl]

The main question is: how did you install the UF? If it was installed using a privileged account and you are now trying to start it with a non-privileged account, it will probably fail, as that account does not have the required permissions on the install dir.

It is possible to run Splunk under a non-admin user, but then it also needs to be installed as such I think (or you need to manually update the permissions on the Splunk install dir such that the account you want to use has access to that).

See also: http://docs.splunk.com/Documentation/Forwarder/7.2.1/Forwarder/InstallaWindowsuniversalforwarderfrom...

[sahiltcs]

Always you need to run service with administrator account and cmd prompt Without admin rights you can't run services, If you don't have admin rights you need to ask user to start the services who have admin rights.

[joebisesi]

On all of our systems that have the UF installed, they are running as Local System Account. They do not and should not be run using the Administrator Account.

[sahiltcs]

Agree with your comments but if we have Universal forwarder installed on another system and we don't have permissions to start the services then we need to ask user to start the services who have admin rights.

[joebisesi]

Are you running as a specific user, or as the Local System Account? Generally speaking, I believe it should use the Local System Account.
Another note, I have always tried starting the service from an Administrator cmd prompt. Not from the Services window.