Getting Data In

Does the Windows Active Directory user for Splunk forwarder need "Remote Desktop access" rights?

splunkreal
Motivator

Hello,

Does the Windows user for Splunk forwarder need "Remote Desktop access" rights?

In general, what kind of Windows user/role/rights is recommended?

Thanks.

0 Karma
1 Solution

kmorris_splunk
Splunk Employee
Splunk Employee

Take a look here (excerpt on choosing the Windows user below):
https://docs.splunk.com/Documentation/Forwarder/6.5.3/Forwarder/InstallaWindowsuniversalforwarderfro...

Choose the Windows user that the universal forwarder should run as
When you install the universal forwarder, you can select the Windows user that the forwarder uses to get data. You have two choices.

Local System. If you specify the Local System user during the installation process, the universal forwarder collects any kind of data that is available on the local host. It cannot collect data from other hosts.
Domain account. This option installs the forwarder as the Windows user you specify. The forwarder has the permissions that have been assigned to that user, and collects data that the user has read access to. It does not collect data from resources that the Windows user does not have access to. If you need to collect data from those resources, you must give the Windows user access to those resources.
Install the forwarder as a Domain account to do any of the following:

Read Event Logs remotely
Collect performance counters remotely
Read network shares for log files
Access the Active Directory schema, using Active Directory monitoring
Choose and configure the user that the universal forwarder should run as before installing the forwarder for remote Windows data collection. If you do not, installation can fail.

If you install as a domain user, specify a user that has access to the data you want to monitor. See Choose the Windows user Splunk should run as in the Splunk Enterprise Installation Manual for concepts and procedures on the user requirements that must be in place before you collect remote Windows data.

If you install as a domain user, you can choose whether or not the user has administrative privileges on the local machine. If you choose not to give the user administrative privileges, the universal forwarder enables "low-privilege" mode. See Install the universal forwarder in low-privilege mode.

View solution in original post

kmorris_splunk
Splunk Employee
Splunk Employee

Take a look here (excerpt on choosing the Windows user below):
https://docs.splunk.com/Documentation/Forwarder/6.5.3/Forwarder/InstallaWindowsuniversalforwarderfro...

Choose the Windows user that the universal forwarder should run as
When you install the universal forwarder, you can select the Windows user that the forwarder uses to get data. You have two choices.

Local System. If you specify the Local System user during the installation process, the universal forwarder collects any kind of data that is available on the local host. It cannot collect data from other hosts.
Domain account. This option installs the forwarder as the Windows user you specify. The forwarder has the permissions that have been assigned to that user, and collects data that the user has read access to. It does not collect data from resources that the Windows user does not have access to. If you need to collect data from those resources, you must give the Windows user access to those resources.
Install the forwarder as a Domain account to do any of the following:

Read Event Logs remotely
Collect performance counters remotely
Read network shares for log files
Access the Active Directory schema, using Active Directory monitoring
Choose and configure the user that the universal forwarder should run as before installing the forwarder for remote Windows data collection. If you do not, installation can fail.

If you install as a domain user, specify a user that has access to the data you want to monitor. See Choose the Windows user Splunk should run as in the Splunk Enterprise Installation Manual for concepts and procedures on the user requirements that must be in place before you collect remote Windows data.

If you install as a domain user, you can choose whether or not the user has administrative privileges on the local machine. If you choose not to give the user administrative privileges, the universal forwarder enables "low-privilege" mode. See Install the universal forwarder in low-privilege mode.

splunkreal
Motivator

Thanks kmorris, could you confirm Remote Desktop access is not required then as we only index local files/registry?

0 Karma

kmorris_splunk
Splunk Employee
Splunk Employee

No, you would not need Remote Desktop access for that user.

Get Updates on the Splunk Community!

Splunk APM & RUM | Upcoming Planned Maintenance

There will be planned maintenance of the streaming infrastructure for Splunk APM and Splunk RUM in the coming ...

Part 2: Diving Deeper With AIOps

Getting the Most Out of Event Correlation and Alert Storm Detection in Splunk IT Service Intelligence   Watch ...

User Groups | Upcoming Events!

If by chance you weren't already aware, the Splunk Community is host to numerous User Groups, organized ...