Getting Data In

On Windows, can I use different credentials to pull WinEvents via WMI?

maverick
Splunk Employee
Splunk Employee

Does Splunk have the ability to use different sets of credentials for different monitoring on Windows?

It appears only one credential can be used for WMI to pull Windows events from across the environment and no local credentials can be used.

For instance, if I have Windows machines on several different domains as well as local DMZ workgroups, I will probably have one than one user account (they won't all be the same).

Also, we may not have the ability to deploy agents out as LWFs, just so you know.

0 Karma
1 Solution

ftk
Motivator

Splunk uses the account it runs under to pull remote WMI.

You have the following options available for remote WMI at this point:

  • In a multi domain scenario you ideally would configure domain or even forest level trust relationships so that your splunk service account can accees remote WMI across domain boundaries.
  • In a workgroup scenario you can create accounts on the remote machines that are identically named to the splunk service account and have the same password. Remote WMI will then work with this account.
  • You could try to create your own scripted input. For example you could create a PowerShell script that pulls the remote WMI events using credentials different from the splunk service account.

If domain trusts and in a workgroup scenario identical logins aren't an option, then forwarders, custom scripted inputs, or forwarding the events via syslog (e.g. winlogd) are your only options. Separate WMI credentials within splunk sound like a great ER though.

View solution in original post

ftk
Motivator

Splunk uses the account it runs under to pull remote WMI.

You have the following options available for remote WMI at this point:

  • In a multi domain scenario you ideally would configure domain or even forest level trust relationships so that your splunk service account can accees remote WMI across domain boundaries.
  • In a workgroup scenario you can create accounts on the remote machines that are identically named to the splunk service account and have the same password. Remote WMI will then work with this account.
  • You could try to create your own scripted input. For example you could create a PowerShell script that pulls the remote WMI events using credentials different from the splunk service account.

If domain trusts and in a workgroup scenario identical logins aren't an option, then forwarders, custom scripted inputs, or forwarding the events via syslog (e.g. winlogd) are your only options. Separate WMI credentials within splunk sound like a great ER though.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...