Getting Data In

Universal forwarder Windows installation (x86 and x64) fails when being pushed by GPO; missing next button?

evilsaint
New Member

Testing this out on two separate machines in our environment as we need to get Splunk up and running on all server by this Friday. The installations process just fine when done manually, and uninstall as well without any errors, but when we try to push them via GPO (auto-install or assign via Computer Policy; publish, assign, or auto-install via User Policy), the application either fails to show up completely, or shows up in the Network Applications but fails to install due to the Next button just... not being there (screenshot attached).

I've gone through nearly every single option on the AD side, including recreating the policies wholesale, as well as re-downloading the .MSI files, and checked that this occurs on multiple servers within differing layers of GPO application, including some with nearly zero other policies being applied at all.

Would it be worth a shot at modifying/transforming the MSI or writing a script to have a GPO run the installers silently? Or does this potentially point to a larger issue in my environment between GP and these specific packages? We also have PDQ available to deploy these if necessary, but I wasn't able to find an EXE-version of the installer; just ZIP files.

Windows Server 2008 R2 DCs, 2008 non-R2 and Windows 7 SP1 member servers that we're trying to install the forwarders on. Splunk Enterprise, installed and working, but potentially not fully configured. Thanks in advance!

alt text

0 Karma

DavidHourani
Super Champion

Hi there,

What command are you using for the insall ?

Should be something like this :

msiexec.exe /i splunkuniversalforwarder_x86.msi LOGON_USERNAME="yourUser" LOGON_PASSWORD="yourPassword" AGREETOLICENSE=Yes /quiet

Hope that helps.

Cheers,
David

0 Karma

9eagles
Explorer

add AGREETOLICENSE=yes /quiet to the end of the command string.
More information about this located here http://docs.splunk.com/Documentation/Forwarder/7.2.0/Forwarder/InstallaWindowsuniversalforwarderfrom...

0 Karma
Get Updates on the Splunk Community!

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...

SignalFlow: What? Why? How?

What is SignalFlow? Splunk Observability Cloud’s analytics engine, SignalFlow, opens up a world of in-depth ...

Federated Search for Amazon S3 | Key Use Cases to Streamline Compliance Workflows

Modern business operations are supported by data compliance. As regulations evolve, organizations must ...