Installation ended prematurely on fresh install of Splunk 7.3.3 on Windows Server 2016 index server.

New Member

Fresh install of Splunk 7.3.3 on Windows Server 2016 index server.

I kept getting the "Splunk installation ended prematurely" with no clear evidence as to why. I tried most of the possible solutions in older posts, with no improvement.

Turns out my domain Splunk service account had been set up with membership in a slew of groups, including the domain admin group. This apparently caused a permissions disconnect in the index server local security policy, where both Deny logon as a batch job and Deny logon as a service included Domain Admin. So, even though my Splunk service account had permission to Logon as a batch job and Logon as a service, it was blocked because of the Domain Admin membership.

I removed the service account from the Domain Admin group and the installation completed successfully.

Labels (1)
Tags (2)
0 Karma

Super Champion

Can you check windows architecture and msi file architecture you downloaded from Splunk. Both should match.

if you are trying to install 32 bit splunk msi file on 64 bit windows server. Mostly you get that error.

If this helps, give a like below.
0 Karma
Get Updates on the Splunk Community!

Splunk Community Platform Survey

Hey Splunk Community, Starting today, the community platform may prompt you to participate in a survey. The ...

Observability Highlights | November 2022 Newsletter

 November 2022Observability CloudEnd Of Support Extension for SignalFx Smart AgentSplunk is extending the End ...

Avoid Certificate Expiry Issues in Splunk Enterprise with Certificate Assist

This blog post is part 2 of 4 of a series on Splunk Assist. Click the links below to see the other ...