Getting Data In

Changing Splunkd Windows Service Account

hjmiii
Engager

In the docs under "Correct the user selected during Windows installation" it states:

"you can go into the Windows Service
Control Manager and specify the
correct information, as long as you
have not started Splunk yet. If you
have started Splunk, you must stop it,
uninstall it and reinstall it."

Can anyone elaborate on why you'd have to reinstall? Does the account get embedded in the configs somewhere in addition to the windows service? I have an install that was done months ago using the local system account, and I'd like to change it to use a domain account. Assigning all the needed permissions and rights shouldn't be a problem.

Tags (2)
0 Karma
1 Solution

robhorton
Explorer

You shouldn't have any issues changing the account that the service is running as. As long as that user has the right to logon as a service, which windows will take care of when you assign the account to the service, you won't have any issues. I installed my system and then switched the service to run using a domain account when WMI did not work and have not had any issues at all. Also, I'm using the built-in Splunk security and it has not thrown any errors when changing the configuration, which would happen if the service account did not have the ability to write to files in the Splunk installation directory.

View solution in original post

0 Karma

robhorton
Explorer

You shouldn't have any issues changing the account that the service is running as. As long as that user has the right to logon as a service, which windows will take care of when you assign the account to the service, you won't have any issues. I installed my system and then switched the service to run using a domain account when WMI did not work and have not had any issues at all. Also, I'm using the built-in Splunk security and it has not thrown any errors when changing the configuration, which would happen if the service account did not have the ability to write to files in the Splunk installation directory.

0 Karma

gkanapathy
Splunk Employee
Splunk Employee

You don't really, but you'd have to change ownership possibly permissions all of the installed files. There is a mix of read/read-write/read only by owner, etc. permissions on various installed files, and others on files that are generated on first-time run, and others as configuration and initial directories for data. So it might be easier to reinstall. Now, you actually could just change the ownership on all of them. Though really, a default installation has everything under c:\Programs\Splunk, so you could just cascade the ownership change down from there and it should be fine.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...