@samalchow
The problem is likely that the program (Splunk UF) doesn't have the right access. Windows keeps very strict records of security events, and needs to be allowed to see them.
As windows user account either local account or domain account with:
- Full control over the Splunk installation directory.
- Read access to any files that you want to index. e.g. Windows application, security, system, application logs, MSSQL logs and so on.
- For standard naming convention it's recommended to create user "Splunk" with the required privileges.
Required Local/Domain Security Policy user rights assignments for the splunkd or splunkforwarder services
- Permission to log on as a service.
- Permission to log on as a batch job
- Permission to replace a process-level token.
- Permission to act as part of the operating system.
- Permission to bypass traverse checking
Additional activity for data required in use-cases
- Enable Windows event and audit logs
- Turn on Process Tracking in your Windows Audit logs (Event ID 4688)
Audit process tracking | Microsoft Learn
- Windows Security Event ID 4648 tracks the explicit use of credentials, as in a run as event or batch login from a scheduled task. You can enable this from your Windows Logon Event policy configuration
Did this help? If yes, please consider giving kudos, marking it as the solution, or commenting for clarification — your feedback keeps the community going!
