Getting Data In

How to install UF via GPO?

ask
Engager

Hi Team,

How to install UF via GPO?

Any specific command line  to run the file .msi that use our username and password?


Thanks and best regards,

Labels (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

The UF installation guide doesn't address GPO, but still should be helpful.  See https://docs.splunk.com/Documentation/Forwarder/8.1.3/Forwarder/InstallaWindowsuniversalforwarderrem...

---
If this reply helps you, Karma would be appreciated.

DuncanClarke
Engager

I tried following the instructions linked but have failed to upgrade successfully.

I am upgrading from 9.0.4 to 9.0.5 using a (startup) script with one line:

MSIEXEC.exe /i splunkforwarder.msi AGREETOLICENSE="yes" DEPLOYMENT_SERVER="servername:port" SPLUNKUSERNAME="admin" SPLUNKPASSWORD="password" /QUIET

However, nothing happens when I reboot the server and it stays at 9.0.4. Running the command in an elevated CMD it doesn't appear to do anything either. If however I remove the /QUIET it then runs through the installation (interactively) without any issues and upgrades to 9.0.5.

Please can you advise if I'm missing something to allow it to run non-interactively using the /QUIET flag?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

There's a note in latest version of the Forwarder Manual that may help https://docs.splunk.com/Documentation/Forwarder/latest/Forwarder/InstallaWindowsuniversalforwarderfr....

If you have enabled Windows auto run, Splunk installation might be failed when the auto run script is failed. As a workaround, you can use cmd /D msiexec.exe /i to install Splunk.
---
If this reply helps you, Karma would be appreciated.
0 Karma

DuncanClarke
Engager

For anyone else doing this, I have created a script which, when run as a startup script in a GPO, appears to work for us:

Computer Configuration -> Policies -> Windows Settings  -> Scripts -> Startup

REM Get the folder from which it was called
SET var=%~dp0
ECHO "%var%splunkforwarder.msi"

REM Install the MSI 
MSIEXEC.exe /i "%var%splunkforwarder.msi" AGREETOLICENSE="yes" DEPLOYMENT_SERVER="server:port" SPLUNKUSERNAME="username" SPLUNKPASSWORD="password" /QN

If you run this script with the latest splunkforwarder.msi in the same directory it should install or update as appropriate.

ask
Engager

Thank you @richgalloway , appreciate on this 😊

0 Karma
Get Updates on the Splunk Community!

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...