Getting Data In

How to install UF via GPO?

ask
Engager

Hi Team,

How to install UF via GPO?

Any specific command line  to run the file .msi that use our username and password?


Thanks and best regards,

Labels (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

The UF installation guide doesn't address GPO, but still should be helpful.  See https://docs.splunk.com/Documentation/Forwarder/8.1.3/Forwarder/InstallaWindowsuniversalforwarderrem...

---
If this reply helps you, Karma would be appreciated.

DuncanClarke
Engager

I tried following the instructions linked but have failed to upgrade successfully.

I am upgrading from 9.0.4 to 9.0.5 using a (startup) script with one line:

MSIEXEC.exe /i splunkforwarder.msi AGREETOLICENSE="yes" DEPLOYMENT_SERVER="servername:port" SPLUNKUSERNAME="admin" SPLUNKPASSWORD="password" /QUIET

However, nothing happens when I reboot the server and it stays at 9.0.4. Running the command in an elevated CMD it doesn't appear to do anything either. If however I remove the /QUIET it then runs through the installation (interactively) without any issues and upgrades to 9.0.5.

Please can you advise if I'm missing something to allow it to run non-interactively using the /QUIET flag?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

There's a note in latest version of the Forwarder Manual that may help https://docs.splunk.com/Documentation/Forwarder/latest/Forwarder/InstallaWindowsuniversalforwarderfr....

If you have enabled Windows auto run, Splunk installation might be failed when the auto run script is failed. As a workaround, you can use cmd /D msiexec.exe /i to install Splunk.
---
If this reply helps you, Karma would be appreciated.
0 Karma

DuncanClarke
Engager

For anyone else doing this, I have created a script which, when run as a startup script in a GPO, appears to work for us:

Computer Configuration -> Policies -> Windows Settings  -> Scripts -> Startup

REM Get the folder from which it was called
SET var=%~dp0
ECHO "%var%splunkforwarder.msi"

REM Install the MSI 
MSIEXEC.exe /i "%var%splunkforwarder.msi" AGREETOLICENSE="yes" DEPLOYMENT_SERVER="server:port" SPLUNKUSERNAME="username" SPLUNKPASSWORD="password" /QN

If you run this script with the latest splunkforwarder.msi in the same directory it should install or update as appropriate.

ask
Engager

Thank you @richgalloway , appreciate on this 😊

0 Karma
Get Updates on the Splunk Community!

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

March Community Office Hours Security Series Uncovered!

Hello Splunk Community! In March, Splunk Community Office Hours spotlighted our fabulous Splunk Threat ...