On Windows, can I use different credentials to pull WinEvents via WMI?

[maverick]

Does Splunk have the ability to use different sets of credentials for different monitoring on Windows?

It appears only one credential can be used for WMI to pull Windows events from across the environment and no local credentials can be used.

For instance, if I have Windows machines on several different domains as well as local DMZ workgroups, I will probably have one than one user account (they won't all be the same).

Also, we may not have the ability to deploy agents out as LWFs, just so you know.

[ftk · Accepted solution]

Splunk uses the account it runs under to pull remote WMI.

You have the following options available for remote WMI at this point:

• In a multi domain scenario you ideally would configure domain or even forest level trust relationships so that your splunk service account can accees remote WMI across domain boundaries.
• In a workgroup scenario you can create accounts on the remote machines that are identically named to the splunk service account and have the same password. Remote WMI will then work with this account.
• You could try to create your own scripted input. For example you could create a PowerShell script that pulls the remote WMI events using credentials different from the splunk service account.

If domain trusts and in a workgroup scenario identical logins aren't an option, then forwarders, custom scripted inputs, or forwarding the events via syslog (e.g. winlogd) are your only options. Separate WMI credentials within splunk sound like a great ER though.