Getting Data In

How to enable WMI data collection on a Domain Server

pmelchiori
Explorer

Hi, I've a problem with the WMI privilege on a Domain Controller running Win 2003 R2. This is what I done:

  • Add user to the groups Performance Log Users and Distributed COM Users Domain groups.
  • Add Splunk's user to the Distributed COM Users local group
  • Enabled all permissions on the WMI tree at root for the Splunk user.
  • no firewall between the pc and the server.

    I can't add my special user to the administrator's group, but if I do everyting works correctly.

There are other Group Policy to enable? other setting to change? thanks

Tags (3)
Get Updates on the Splunk Community!

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars this month. This ...

They're back! Join the SplunkTrust and MVP at .conf24

With our highly anticipated annual conference, .conf, comes the fez-wearers you can trust! The SplunkTrust, as ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...