Join the Conversation
- Find Answers
- :
- Splunk Administration
- :
- Getting Data In
- :
- Re: On Windows, can I use different credentials to...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Does Splunk have the ability to use different sets of credentials for different monitoring on Windows?
It appears only one credential can be used for WMI to pull Windows events from across the environment and no local credentials can be used.
For instance, if I have Windows machines on several different domains as well as local DMZ workgroups, I will probably have one than one user account (they won't all be the same).
Also, we may not have the ability to deploy agents out as LWFs, just so you know.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Splunk uses the account it runs under to pull remote WMI.
You have the following options available for remote WMI at this point:
- In a multi domain scenario you ideally would configure domain or even forest level trust relationships so that your splunk service account can accees remote WMI across domain boundaries.
- In a workgroup scenario you can create accounts on the remote machines that are identically named to the splunk service account and have the same password. Remote WMI will then work with this account.
- You could try to create your own scripted input. For example you could create a PowerShell script that pulls the remote WMI events using credentials different from the splunk service account.
If domain trusts and in a workgroup scenario identical logins aren't an option, then forwarders, custom scripted inputs, or forwarding the events via syslog (e.g. winlogd) are your only options. Separate WMI credentials within splunk sound like a great ER though.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Splunk uses the account it runs under to pull remote WMI.
You have the following options available for remote WMI at this point:
- In a multi domain scenario you ideally would configure domain or even forest level trust relationships so that your splunk service account can accees remote WMI across domain boundaries.
- In a workgroup scenario you can create accounts on the remote machines that are identically named to the splunk service account and have the same password. Remote WMI will then work with this account.
- You could try to create your own scripted input. For example you could create a PowerShell script that pulls the remote WMI events using credentials different from the splunk service account.
If domain trusts and in a workgroup scenario identical logins aren't an option, then forwarders, custom scripted inputs, or forwarding the events via syslog (e.g. winlogd) are your only options. Separate WMI credentials within splunk sound like a great ER though.
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Announcing Modern Navigation: A New Era of Splunk User Experience
Modernize your Splunk Apps – Introducing Python 3.13 in Splunk
Step into “Hunt the Insider: An Splunk ES Premier Mystery” to catch a cybercriminal ...
