Installation

Setting up to roll out forwarder "Add rights to the GPO" breaks windows 10 logon

Kucster
Engager

I'm working on rolling out the forwarder to all my companies clients and I found the "Prepare your Windows network to run Splunk Enterprise as a network or domain user" guide. I've gone through the steps but skipped "Change Administrators group membership on each host" , we do not have many hosts and I simply did it manually.

But after I apply the GPO to the clients the users are no longer able to logon, they simply get a black screen. I've confirmed if I disable the GPO they are able to logon just fine. I can't image any reason for this so any help would be greatly appreciated. I've attached a screen shot of the GPO I created and all our users are running Win 10 with the latest updates.

Example-9-29-2020.png

Labels (2)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Why run Splunk under a domain account?  The documentation at https://docs.splunk.com/Documentation/Splunk/8.0.6/Installation/ChoosetheuserSplunkshouldrunas#About... lists 4 reasons for using a domain account.  If you don't meet any of those requirements then you'll be much happier running Splunk under a local account.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

Why run Splunk under a domain account?  The documentation at https://docs.splunk.com/Documentation/Splunk/8.0.6/Installation/ChoosetheuserSplunkshouldrunas#About... lists 4 reasons for using a domain account.  If you don't meet any of those requirements then you'll be much happier running Splunk under a local account.

---
If this reply helps you, Karma would be appreciated.

Kucster
Engager

Thank you so much that worked much better

0 Karma
Get Updates on the Splunk Community!

New Splunk Observability innovations: Deeper visibility and smarter alerting to ...

You asked, we delivered. Splunk Observability Cloud has several new innovations giving you deeper visibility ...

Synthetic Monitoring: Not your Grandma’s Polyester! Tech Talk: DevOps Edition

Register today and join TekStream on Tuesday, February 28 at 11am PT/2pm ET for a demonstration of Splunk ...

Instrumenting Java Websocket Messaging

Instrumenting Java Websocket MessagingThis article is a code-based discussion of passing OpenTelemetry trace ...