Getting Data In

Do I need Domain Account for UF when DC monitoring and Windows OS for DS?

jonwick
Path Finder

Hello Splunkers,

Do I need domain account  for UF to monitor Domain Controller ?

I suppose, I need UF on domain account when monitoring AD.

If I only wish to monitor windows standard even logs from DC then local system account is enough.

My DS would be on Linux based, do I need another new  DS on windows to push apps on DC??

In docs it has been mentioned that Splunk Enterprise should be on Windows to monitor DC, do they only mean it for indexer??? Or DS should also be  Windows based?

 

0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @jonwick,

you don't need a domain account to monitor a DC using Forwarder, you need only a user with privileges to read Windows EventLogs and execute scripts.

If you install Splunk UF as SYSTEM_LOCAL, you have all the needed privileges.

To be more sure, see the documentation about the app to use (I think Splunk for Windows Infrastructure) that describes the TAs to use and the needed requirements.

About the Operative System of Deployment Server and other Splunk servers, see my answer to your other question https://community.splunk.com/t5/Deployment-Architecture/Are-there-any-ideal-exceptions-where-DS-has-...

Ciao.

Giuseppe

View solution in original post

gcusello
SplunkTrust
SplunkTrust

Hi @jonwick,

you don't need a domain account to monitor a DC using Forwarder, you need only a user with privileges to read Windows EventLogs and execute scripts.

If you install Splunk UF as SYSTEM_LOCAL, you have all the needed privileges.

To be more sure, see the documentation about the app to use (I think Splunk for Windows Infrastructure) that describes the TAs to use and the needed requirements.

About the Operative System of Deployment Server and other Splunk servers, see my answer to your other question https://community.splunk.com/t5/Deployment-Architecture/Are-there-any-ideal-exceptions-where-DS-has-...

Ciao.

Giuseppe

jonwick
Path Finder

Thanks @gcusello 

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @jonwick,

you're welcome!

Ciao and happy splunking.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...