Universal forwarder - gMSA - EventID 7000

[mhobbelen]

Hello, in ou're environment we've configured the forwarders (Windows, version 6.6.3) to use a gMSA account to run the splunkd service. This account has been granted the correct permissions (as described in the installation documentation).

After an (expected) restart on some systems the service won't startup correctly (Eventid 7000, The SplunkForwarder service failed to start due to the following error:
The service did not start due to a logon failure.)

When this issue arrises, the Test-ADServiceAccount returns a true value. The PrincipalsAllowedToRetrieveManagedPassword properties has been configured with the correct systems that use the gMSA account.

A manual restart will fix this issue. offcourse, this can be trapped within a monitoring solution, or with an action combined to this event, but this is working around an issue imho. What's the best way to troubleshoot/fix this issue.

[heikowz]

Hello,
set the starttype of the SplunkForwarder to "auto-delayed" then it works well.
The reason for the error is that the network connection is not complet started during the strat of the SF and it can not verify the gMSA Password with the DomainController.
Regards Heiko