Options on installing universal forwarders on "Windows Machines"

[ranjitbrhm1]

Hello All, Im a bit confused with the installation of a UF on the windows machine. According to the documents, there are 2 methods to install splunk UF. One with the local account and one with the domain account. Now, My question is lets say im setting it up on a "web server" , Should i select local account or domain account to pull the web server logs, in this case the iis logs. Also what excatly do they mean when they say one can monitor logs from other domain account as well if it is provided with a domain username and password? Is it like i have a server and there are multiple people logging on to that "specific server" also if i install it as a domain user, will it not collect the system logs by default? Also importantly just by installing a UF on 1 server with domain credentials does it mean i dont have to install UF on all the servers?

[FrankVl · Accepted solution]

Let's go one by one:
Q: Should i select local account or domain account to pull the web server logs, in this case the iis logs.?
A: That does not so much depend on which logs you want to collect. It is more of a security decision to be made. Installing splunk to run under local system account is simple at install time and will usually mean you won't have to do much work to get it access to all kinds of logs on the machine. Using a domain account will allow you to run splunk with less privileges (so reducing some risks of a vulnerability in Splunk being abused to gain admin access on that machine), but is a bit more hassle to set up and manage.

Q: Also what excatly do they mean when they say one can monitor logs from other domain account as well if it is provided with a domain username and password?
A: Where exactly did you get this from? I don't think I completely understand this question.

Q: also if i install it as a domain user, will it not collect the system logs by default?
A: a normal, unprivileged domain user may not have access to the windows event logs by default, this is some of the extra effort you need to put in when using a domain account.

Q: Also importantly just by installing a UF on 1 server with domain credentials does it mean i dont have to install UF on all the servers?
A: No, it does not. While it is possible to remotely monitor windows hosts using WMI, this is typically not recommended and requires the use of a Heavy Forwarder, not a UF: http://docs.splunk.com/Documentation/Splunk/latest/Data/ConsiderationsfordecidinghowtomonitorWindows...

[ranjitbrhm1]

Think i read something else. I understand now. Thanks.