Install splunk forwarder via command prompt to run under virtual account

[macear]

When installing Splunk Universal Forwarder on Windows via GUI we can specify to run splunk under virtual account.

How can I specify the same when installing via command prompt?
I tried the following command in my batch script, but eventually splunk forwarder was installed under SYSTEM..

msiexec.exe /i splunkforwarder-8.0.6-152fb4b2bb96-x64-release.msi AGREETOLICENSE=yes SET_ADMIN_USER=0 SPLUNKUSERNAME=%user% SPLUNKPASSWORD=%password% LOGONUSERNAME="NT SERVICE\SplunkForwarder" /L*v %installation_log% /quiet

Is there this possibility?

[jho-splunk · Accepted solution]

Hi @macear ,

Don't specify LOGON_USERNAME and add USE_VIRTUAL_ACCOUNT=1.

Cheers,

 - Jo.