Getting Data In

How to hide Splunk forwarder from add/remove programs list?

adam_jones
Engager

I am pushing the Splunk forwarder out to a bunch of workstations. I don't want users to be able to remove the forwarder once it's installed. I've noticed that on my workstation I can go into the Add/Remove programs list in Windows and uninstall it. Also, I can stop the service from running. Is there any way to hide the forwarder from these places so that users don't remove it? Some of the users will have local admin rights so I don't think I can take away their ability to uninstall, but if it's hidden it's more likely to stay around.

0 Karma

javiergn
Super Champion

Hi,

Take a look at this: http://www.winhelponline.com/articles/15/1/How-to-hide-an-entry-in-the-AddRemove-Programs-applet.htm...

With regards to the service start/stop, while you can't easily stop your local admins from starting/stopping the Splunk service on Windows, you can monitor what's going on periodically:

  • Monitor your System Event Logs and look for "Event Source: Service Control Manager" where description contains the name of the Splunk service. This will tell you when the service was stopped / started
  • Use Splunk On Splunk or the Distributed Management Console to monitor the status of your Universal Forwarders. There are built-in searches to list UFs not reporting after certain amount of time that you can tweak to customise your needs
  • If the number of Windows hosts you want to watch is not extremely huge you can always monitor the Splunk services remotely every minute or so by writing some basic PowerShell that either via WMI or built-in cmdlets keeps an eye on those services. A multithreaded approach is recommended here

But most importantly, there's something that really helped me in the past: get support from senior management on this. If someone senior enough informs your employees that stopping certain security/logging tools is not permitted unless there's a valid reason for it, people would think twice before doing so. It won't stop them but if they do, and you manage to find out, there will be consequences.

Hope that helps.

Thanks,
J

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...