- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hello Splunkers,
Do I need domain account for UF to monitor Domain Controller ?
I suppose, I need UF on domain account when monitoring AD.
If I only wish to monitor windows standard even logs from DC then local system account is enough.
My DS would be on Linux based, do I need another new DS on windows to push apps on DC??
In docs it has been mentioned that Splunk Enterprise should be on Windows to monitor DC, do they only mean it for indexer??? Or DS should also be Windows based?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content


Hi @jonwick,
you don't need a domain account to monitor a DC using Forwarder, you need only a user with privileges to read Windows EventLogs and execute scripts.
If you install Splunk UF as SYSTEM_LOCAL, you have all the needed privileges.
To be more sure, see the documentation about the app to use (I think Splunk for Windows Infrastructure) that describes the TAs to use and the needed requirements.
About the Operative System of Deployment Server and other Splunk servers, see my answer to your other question https://community.splunk.com/t5/Deployment-Architecture/Are-there-any-ideal-exceptions-where-DS-has-...
Ciao.
Giuseppe
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content


Hi @jonwick,
you don't need a domain account to monitor a DC using Forwarder, you need only a user with privileges to read Windows EventLogs and execute scripts.
If you install Splunk UF as SYSTEM_LOCAL, you have all the needed privileges.
To be more sure, see the documentation about the app to use (I think Splunk for Windows Infrastructure) that describes the TAs to use and the needed requirements.
About the Operative System of Deployment Server and other Splunk servers, see my answer to your other question https://community.splunk.com/t5/Deployment-Architecture/Are-there-any-ideal-exceptions-where-DS-has-...
Ciao.
Giuseppe
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thanks @gcusello
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content


