Do I need Domain Account for UF when DC monitoring and Windows OS for DS?

[jonwick]

Hello Splunkers,

Do I need domain account  for UF to monitor Domain Controller ?

I suppose, I need UF on domain account when monitoring AD.

If I only wish to monitor windows standard even logs from DC then local system account is enough.

My DS would be on Linux based, do I need another new  DS on windows to push apps on DC??

In docs it has been mentioned that Splunk Enterprise should be on Windows to monitor DC, do they only mean it for indexer??? Or DS should also be  Windows based?

[gcusello · Accepted solution]

Hi @jonwick,

you don't need a domain account to monitor a DC using Forwarder, you need only a user with privileges to read Windows EventLogs and execute scripts.

If you install Splunk UF as SYSTEM_LOCAL, you have all the needed privileges.

To be more sure, see the documentation about the app to use (I think Splunk for Windows Infrastructure) that describes the TAs to use and the needed requirements.

About the Operative System of Deployment Server and other Splunk servers, see my answer to your other question https://community.splunk.com/t5/Deployment-Architecture/Are-there-any-ideal-exceptions-where-DS-has-...

Ciao.

Giuseppe

[jonwick]

Thanks @gcusello 

[gcusello]

Hi @jonwick,

you're welcome!

Ciao and happy splunking.

Giuseppe