Installation Universal Forwarder on Citrix Provision servers- Why do the servers keep generating new GUID on reboot?

Path Finder


Issue: Citrix servers keep generating new GUID on reboot.

I followed these steps from Splunk docs for installing Splunk on imaging software.


On the Imaging Server

1. msiexec /i <executable> GENRANDOMPASSWORD=1 AGREETOLICENSE=yes LAUNCHSPLUNK=0 /quiet

2. Copied over deployment server app

3. Copied over splunk.secret

4. Removed sslPassword from server.conf. (Even not starting splunk it would still generate a password in server.conf and splunk wouldn't start when an old password is set with the new splunk.secret)

5. splunk.exe clone-pre-clear-config


On the new system

1. A task was created to restart splunk.



1. new system checks in with correct hostname, ip and guid

2. on reboots system keeps generating new guid in deployment server

Labels (2)
0 Karma
Get Updates on the Splunk Community!

There's No Place Like Chrome and the Splunk Platform

Watch On DemandMalware. Risky Extensions. Data Exfiltration. End-users are increasingly reliant on browsers to ...

The Great Resilience Quest: 5th Leaderboard Update

The fifth leaderboard update for The Great Resilience Quest is out &gt;&gt; &#x1f3c6; Check out the ...

Devesh Logendran, Splunk, and the Singapore Cyber Conquest

At this year’s Splunk University, I had the privilege of chatting with Devesh Logendran, one of the winners in ...