Installation

Setting up to roll out forwarder "Add rights to the GPO" breaks windows 10 logon

Kucster
Engager

I'm working on rolling out the forwarder to all my companies clients and I found the "Prepare your Windows network to run Splunk Enterprise as a network or domain user" guide. I've gone through the steps but skipped "Change Administrators group membership on each host" , we do not have many hosts and I simply did it manually.

But after I apply the GPO to the clients the users are no longer able to logon, they simply get a black screen. I've confirmed if I disable the GPO they are able to logon just fine. I can't image any reason for this so any help would be greatly appreciated. I've attached a screen shot of the GPO I created and all our users are running Win 10 with the latest updates.

Example-9-29-2020.png

Labels (2)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Why run Splunk under a domain account?  The documentation at https://docs.splunk.com/Documentation/Splunk/8.0.6/Installation/ChoosetheuserSplunkshouldrunas#About... lists 4 reasons for using a domain account.  If you don't meet any of those requirements then you'll be much happier running Splunk under a local account.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

Why run Splunk under a domain account?  The documentation at https://docs.splunk.com/Documentation/Splunk/8.0.6/Installation/ChoosetheuserSplunkshouldrunas#About... lists 4 reasons for using a domain account.  If you don't meet any of those requirements then you'll be much happier running Splunk under a local account.

---
If this reply helps you, Karma would be appreciated.

Kucster
Engager

Thank you so much that worked much better

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...