Getting Data In

Why should I install Splunk on Domain Controllers?

medma1934
New Member

Currently debating installing Splunk on all Domain Controllers. Have a back and forth with my colleagues and security team as to if there is a real need for Splunk to be on all DC's. Currently using Splunk 6.5.1 on 6 DC's within 2 sites out of 11 DC's within 4 sites.

Debate is that it should only be installed on the PDC, however others say it should be installed on all. Any suggestions greatly appreciated.

0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

I hope you mean you install Splunk Universal Forwarders (SUF) on your DCs rather than Splunk Core.

I think the decision comes down to what behavior you want when a DC not logging to Splunk becomes primary. When a secondary DC takes over as primary, it should would be nice to have that event logged in Splunk, which probably won't happen if not all DCs run SUF. Also, whatever dashboards or alerts you have will continue to function uninterrupted if the new PDC is already logging to Splunk.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

I hope you mean you install Splunk Universal Forwarders (SUF) on your DCs rather than Splunk Core.

I think the decision comes down to what behavior you want when a DC not logging to Splunk becomes primary. When a secondary DC takes over as primary, it should would be nice to have that event logged in Splunk, which probably won't happen if not all DCs run SUF. Also, whatever dashboards or alerts you have will continue to function uninterrupted if the new PDC is already logging to Splunk.

---
If this reply helps you, Karma would be appreciated.
0 Karma

medma1934
New Member

Thanks. on to battle.

Appreciate the feed back.

-Mike

0 Karma

medma1934
New Member

Thanks, Splunk agent is the only thing running on a few Domain Controllers. Ultimately would like to put on all remaining DC but the pushback from the team is why? The team thinks that running splunk agent on the PDC is enough. Other than the reason of what if you move PDC to another it will log uninterrupted, i find myself having a hard time justifying why Splunk agent should be on all.

As i understand, Most events are replicated across all Domain Controllers for Authentication purposes of a domain but security events as i understand dont. I am in favor of adding Splunk agent more so because of security events in this day and age.

Appreciate your info.

Thanks

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Your security concerns are well-founded. An attacker on your SDCs might go unnoticed without Splunk logging.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Strengthen Your Future: A Look Back at Splunk 10 Innovations and .conf25 Highlights!

The Big One: Splunk 10 is Here!  The moment many of you have been waiting for has arrived! We are thrilled to ...

Now Offering the AI Assistant Usage Dashboard in Cloud Monitoring Console

Today, we’re excited to announce the release of a brand new AI assistant usage dashboard in Cloud Monitoring ...

Stay Connected: Your Guide to October Tech Talks, Office Hours, and Webinars!

What are Community Office Hours? Community Office Hours is an interactive 60-minute Zoom series where ...