Getting Data In

Do I need Domain Account for UF when DC monitoring and Windows OS for DS?

jonwick
Path Finder

Hello Splunkers,

Do I need domain account  for UF to monitor Domain Controller ?

I suppose, I need UF on domain account when monitoring AD.

If I only wish to monitor windows standard even logs from DC then local system account is enough.

My DS would be on Linux based, do I need another new  DS on windows to push apps on DC??

In docs it has been mentioned that Splunk Enterprise should be on Windows to monitor DC, do they only mean it for indexer??? Or DS should also be  Windows based?

 

0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @jonwick,

you don't need a domain account to monitor a DC using Forwarder, you need only a user with privileges to read Windows EventLogs and execute scripts.

If you install Splunk UF as SYSTEM_LOCAL, you have all the needed privileges.

To be more sure, see the documentation about the app to use (I think Splunk for Windows Infrastructure) that describes the TAs to use and the needed requirements.

About the Operative System of Deployment Server and other Splunk servers, see my answer to your other question https://community.splunk.com/t5/Deployment-Architecture/Are-there-any-ideal-exceptions-where-DS-has-...

Ciao.

Giuseppe

View solution in original post

gcusello
SplunkTrust
SplunkTrust

Hi @jonwick,

you don't need a domain account to monitor a DC using Forwarder, you need only a user with privileges to read Windows EventLogs and execute scripts.

If you install Splunk UF as SYSTEM_LOCAL, you have all the needed privileges.

To be more sure, see the documentation about the app to use (I think Splunk for Windows Infrastructure) that describes the TAs to use and the needed requirements.

About the Operative System of Deployment Server and other Splunk servers, see my answer to your other question https://community.splunk.com/t5/Deployment-Architecture/Are-there-any-ideal-exceptions-where-DS-has-...

Ciao.

Giuseppe

jonwick
Path Finder

Thanks @gcusello 

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @jonwick,

you're welcome!

Ciao and happy splunking.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

Announcing the Expansion of the Splunk Academic Alliance Program

The Splunk Community is more than just an online forum — it’s a network of passionate users, administrators, ...

Learn Splunk Insider Insights, Do More With Gen AI, & Find 20+ New Use Cases You Can ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Buttercup Games: Further Dashboarding Techniques (Part 7)

This series of blogs assumes you have already completed the Splunk Enterprise Search Tutorial as it uses the ...