Domain Account for UF

[jonwick]

Hi Splunkers,

I'm realtively new with Splunk and trying to understand few aspects and need clarifications on below

In Which cases or Applications monitoring does UF needs domain account.

Does monitoring of Domain Controller server events needs domain Account?

Is the general approach to keep local account for UFs on servers unless it is explicitly needed?

What are roles are used for while installing UFs?

What is UF's username and password used for? Is it for security purpose so that anyone doesnt make any changes from CLI? Am I right?

[gcusello · Accepted solution]

i @jonwick,

I usually install Universal Forwarder as a SYSTEM_LOCAL, but, as you can read at https://docs.splunk.com/Documentation/Forwarder/8.0.6/Forwarder/InstallaWindowsuniversalforwarderfro...  , you can install it also as a Domain Account.

The reasons are:

• Read Event Logs remotely
• Collect performance counters remotely,
• Read network shares for log files,
• Access the Active Directory schema,
• using Active Directory monitoring.

If you install as a domain user, you can choose whether or not the user has administrative privileges on the local machine. If you choose not to give the user administrative privileges, the universal forwarder enables "low-privilege" mode.

Ciao.

Giuseppe