Installation issue

[splunk9000]

I received this error message: splunk enterprise setup wizard ended prematurely because of an error. Your system has not been modified.
I use Windows Server 2012 R2. I received this error only when I selected domain\user account

Any help will be good. Thanks.

[jkat54]

Apparently the domain user account doesnt have permission to read and write in the splunk folder.

OR doesnt have permission to run as a service (Group Policy).
https://technet.microsoft.com/en-us/library/cc794944(v=ws.10).aspx <- allow user to run as service

Abbreviated solution:
A local administrator will need to.... go to start -> run -> gpedit.msc [click ok]

GroupPolicyObject [ComputerName] Policy -> Computer Configuration -> Windows Settings -> Security Settings ->Local Policies ->User Rights Assignment -> change "Log on as a service." to have domain user account within the list of allowed accounts.

[splunk9000]

I use GPO. I have the domain group "domain\Splunk Accounts". I created the "domain\Splunk" user and added it to "domain\Splunk Accounts" group, This group has "Log on as a service" rights on the server where I try to install Splunk server.

[jkat54]

So does the user have write access to program files directory?

[ChrisG]

What version of Splunk Enterprise? Are you installing in English or another language? Does your domain user have the right permissions to install? You might have to run the installation as Administrator.

There are a few other Answers postings about the same error message:

• https://answers.splunk.com/answers/248268/why-am-i-unable-to-install-the-splunk-623-free-ver.html
• https://answers.splunk.com/answers/225447/windows-installation-ends-prematurely-and-then-won.html
• https://answers.splunk.com/answers/189210/why-am-i-getting-error-universal-forwarder-setup-w.html

[splunk9000]

Hi Chris,

1. splunk-6.3.2-aaff59bb082c-x64-release.msi
2. I use English system locale
3. I use the domain admin account for installing
4. Yes, I run splunk-6.3.2-aaff59bb082c-x64-release.msi under Administrator command prompt

Thanks,
Arthur