Install Universal Forwarder on Exchange Server

[phamanh1652]

I’ve installed the Universal Forwarder on an Exchange Server 2016. It successfully collects most of the logs defined in inputs.conf from TA-Exchange-Mailbox, except for the following:

1. MSExchange:2013:AdminAudit

Checked using: Get-AdminAuditLogConfig | Select-Object AdminAuditLogEnabled

Result: AdminAuditLogEnabled = True

2. MSExchange:2013:MessageTracking

Verified the path and files exist in the directory.

C:\Program Files\Microsoft\Exchange Server\V15\TransportRoles\Logs\MessageTracking

3. MSExchange:2013:Folder-Usage and MSExchange:2013:Mailbox-Usage unsure how to check this log source.

Is there anything I can check or configure to fix this issue?

[gcusello]

Hi @phamanh1652 ,

as described at https://docs.splunk.com/Documentation/AddOns/released/MSExchange/TroubleshootTA-Mailbox, did you checked if the Domain User Account has Records Management and Organization Management roles enabled?

Otherwise the TA cannot read these logs.

Ciao.

Giuseppe

[phamanh1652]

Hi @gcusello 

Thank you for your response,

My current service account for SplunkForwarder is NT Service\SplunkForwarder. I'm wondering—can I change this account directly from Log On tab, or do I need to reinstall the Universal Forwarder using a domain account that has the necessary permissions and roles?

Regards,

[gcusello]

Hi @phamanh1652 ,

you have to modify the profile in the Windows role, not in Splunk.

Ciao.

Giuseppe

[phamanh1652]

Hi @gcusello 

I see that the SplunkForwarder service is currently running under the NT SERVICE\SplunkForwarder account. Is it possible to switch this to a domain user account with the required permissions, or would I need to reinstall the Universal Forwarder using that domain account?

Regards,

[PickleRick]

I don't recall if you can add _local_ user to _domain_ group. (I know you can do the opposite but my win-fu is not that strong).

You can either try to fiddle with local permissions to grant the local SplunkForwarder right to read the logs or (and this will probably be easier) - change the user the UF runs as.

The latter requires creating a domain user (preferably a Domain Service Account or however it's called nowadays), changing ownership of the UF installation directory (which is quite easy obviously) and setting the service to run as that user.

The docs say that the user UF runs as needs (additionally to what is needed to read Exchange logs):

[...]

To allow the least privileged user to enable universal forwarder features, grant all or some of the following permissions in the dialog box: Grant Windows privileges to enable universal forwarder features:

 Permission Function

SeBackupPrivilege	Select to grant the least privileged user READ ONLY permissions for files.
SeSecurityPrivilege	Select to allow the user to collect Windows security event logs. NOTE: The SeSecurityPrivilege permissions are READ/WRITE by design on Windows. This means that the user can also modify and delete Security Event Logs. To mitigate this issue, see "Manage SePrivilegeUser permissions" in this topic.
SeImpersonatePrivilege	Select to enable the capability to add the least privilege user to new Windows users/groups after the universal forwarder installation. This grants more permissions to the universal forwarder to collect data from secure sources.

Grant Windows groups privileges to enable universal forwarder features:

 Permission Function

Performance Monitor Users

Select for WMI/perfmon inputs to collect performance data.

[gcusello]

Hi @phamanh1652 ,

yes, you can switch a domain account, or add the splunkforwarder to the local accounts, givng to it the above grants.

Ciao.

Giuseppe