Getting Data In

Installing Splunk 9.1.1.0 as a Local Admin on Windows OS using Ansible Playbook

FAA
Observer

Hi, 

 most of the splunk forwarder installed on servers are on NT Authority and will like to change this to local admin. I have tried modifying the ansible roles to fix the this but havent been successful any ideas on what can be done will be appreciated. 

Labels (2)
0 Karma

dural_yyz
Motivator
USE_LOCAL_SYSTEMInstall the universal forwarder as a local system0

 

The default flag on install is 0 - update the install line to flag this set to 1.

This is no longer best practice for security so be prepared to update future installs to fit with best practices.

0 Karma

FelixLeh
Contributor

Everything that is needed should hopefully be found here:
https://docs.splunk.com/Documentation/Forwarder/9.1.1/Forwarder/InstallaWindowsuniversalforwarderfro...

LOGON_USERNAME="<domain\username>"

LOGON_PASSWORD="<pass>"

 Provide domain\username and password information for the user to run the SplunkForwarder service. Specify the domain with the username in the format: domain\username. If you don't include these flags, the universal forwarder installs as the Local System user.

 

The Troubleshooting at the bottom of the link could also lead to answers regarding permissions and local admin groups

0 Karma

FAA
Observer

Please how can I change from the default NT Authority to Local System account as the service Logon . I am trying to do this with Ansible 

0 Karma
Get Updates on the Splunk Community!

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Announcing the General Availability of Splunk Enterprise Security 8.1!

We are pleased to announce the general availability of Splunk Enterprise Security 8.1. Splunk becomes the only ...

Developer Spotlight with William Searle

The Splunk Guy: A Developer’s Path from Web to Cloud William is a Splunk Professional Services Consultant with ...