Getting Data In

Installing Splunk 9.1.1.0 as a Local Admin on Windows OS using Ansible Playbook

FAA
Observer

Hi, 

 most of the splunk forwarder installed on servers are on NT Authority and will like to change this to local admin. I have tried modifying the ansible roles to fix the this but havent been successful any ideas on what can be done will be appreciated. 

Labels (2)
0 Karma

dural_yyz
Motivator
USE_LOCAL_SYSTEMInstall the universal forwarder as a local system0

 

The default flag on install is 0 - update the install line to flag this set to 1.

This is no longer best practice for security so be prepared to update future installs to fit with best practices.

0 Karma

FelixLeh
Contributor

Everything that is needed should hopefully be found here:
https://docs.splunk.com/Documentation/Forwarder/9.1.1/Forwarder/InstallaWindowsuniversalforwarderfro...

LOGON_USERNAME="<domain\username>"

LOGON_PASSWORD="<pass>"

 Provide domain\username and password information for the user to run the SplunkForwarder service. Specify the domain with the username in the format: domain\username. If you don't include these flags, the universal forwarder installs as the Local System user.

 

The Troubleshooting at the bottom of the link could also lead to answers regarding permissions and local admin groups

0 Karma

FAA
Observer

Please how can I change from the default NT Authority to Local System account as the service Logon . I am trying to do this with Ansible 

0 Karma
Get Updates on the Splunk Community!

Developer Spotlight with William Searle

The Splunk Guy: A Developer’s Path from Web to Cloud William is a Splunk Professional Services Consultant with ...

Major Splunk Upgrade – Prepare your Environment for Splunk 10 Now!

Attention App Developers: Test Your Apps with the Splunk 10.0 Beta and Ensure Compatibility Before the ...

Stay Connected: Your Guide to June Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...