Getting Data In

Disable User Account Control for splunk.exe

wiz561
Explorer

Hi!

It seems like with the WIndows version of splunk, you must have admin to run splunk.exe, which includes command line queries. Since I want non-admin users of the machine to review audit logs, how can I change this so that other users can run splunk.exe?

I checked the "run as admin" in the compatiability tab of the file, but the "run this program as administrator" box is already unchecked, but I still need admin to run it.

Thanks!

Tags (2)
0 Karma

wiz561
Explorer

It turns out that you don't need to authenticate to execute the splunk.exe file, like you do when you're an admin.

It's strange that you have to authenticate as an admin when you run it as an admin, but as a user, you don't. So, false positive and everything is fine.

Thanks!

0 Karma

ilv2splunk
Explorer

So if you right click on the splunk.exe in the bin folder and go to the compatibility tab.
Did you click "change settings for all users" and then set privilege level to run this program as administrator?

Alternativly can you give the non admin users ability to view the audit index though role permissions?

0 Karma
Get Updates on the Splunk Community!

Don't wait! Accept the Mission Possible: Splunk Adoption Challenge Now and Win ...

Attention everyone! We have exciting news to share! We are recruiting new members for the Mission Possible: ...

Unify Your SecOps with Splunk Mission Control

In today’s post, I'm excited to share some recent Splunk Mission Control innovations. With Splunk Mission ...

Data Preparation Made Easy: SPL2 for Edge Processor

By now, you may have heard the exciting news that Edge Processor, the easy-to-use Splunk data preparation tool ...