Getting Data In

How to configure non domain account for WMI access

rahulkumarfgf
Explorer

Hello Everyone,

I have a service account that I need to configure to collect WMI data from domain controllers. This account can't be an admin on the domain controller, so am trying to provide least privilege access to my account as per the documentation below:
https://docs.splunk.com/Documentation/Splunk/8.0.1/Data/MonitorWMIdata

I am running splunk enterprise 8.0.1 and have a basic architecture with only one instance of splunk running as an indexer and search head. I have not installed any forwarder(not allowed to install that on DC as per policy).

So far, I have tried everything in this link:
https://answers.splunk.com/answers/2703/how-to-enable-wmi-data-collection-on-a-domain-server.html

However, I am still not able to connect to the DC. The above link says that it's been tried on windows 2003. I have windows server 2012 and 2016. Could someone please assist me in getting this fixed? Any help would be greatly appreciated. Please let me know if you require further information. I apologize if I have missed anything crucial. I am still a newbie trying to find my way through it.

Thank You!

0 Karma

rahulkumarfgf
Explorer

Hello Splunkers!

Could someone please guide me on this?

0 Karma
Get Updates on the Splunk Community!

Security Highlights: September 2022 Newsletter

 September 2022 The Splunk App for Fraud Analytics (SFA) is now Splunk SupportedUse your existing Splunk ...

Platform Highlights | September 2022 Newsletter

 September 2022 What’s New in 9.0 and How to UpgradeGet a walk through of what is new Splunk Enterprise 9.0 ...

Observability Highlights | September 2022 Newsletter

 September 2022 Splunk Observability SuiteAccess to "Classic" SignalFx Interface Will be Removed on Sept 30, ...