Installation

Setting up to roll out forwarder "Add rights to the GPO" breaks windows 10 logon

Kucster
Engager

I'm working on rolling out the forwarder to all my companies clients and I found the "Prepare your Windows network to run Splunk Enterprise as a network or domain user" guide. I've gone through the steps but skipped "Change Administrators group membership on each host" , we do not have many hosts and I simply did it manually.

But after I apply the GPO to the clients the users are no longer able to logon, they simply get a black screen. I've confirmed if I disable the GPO they are able to logon just fine. I can't image any reason for this so any help would be greatly appreciated. I've attached a screen shot of the GPO I created and all our users are running Win 10 with the latest updates.

Example-9-29-2020.png

Labels (2)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Why run Splunk under a domain account?  The documentation at https://docs.splunk.com/Documentation/Splunk/8.0.6/Installation/ChoosetheuserSplunkshouldrunas#About... lists 4 reasons for using a domain account.  If you don't meet any of those requirements then you'll be much happier running Splunk under a local account.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

Why run Splunk under a domain account?  The documentation at https://docs.splunk.com/Documentation/Splunk/8.0.6/Installation/ChoosetheuserSplunkshouldrunas#About... lists 4 reasons for using a domain account.  If you don't meet any of those requirements then you'll be much happier running Splunk under a local account.

---
If this reply helps you, Karma would be appreciated.

Kucster
Engager

Thank you so much that worked much better

0 Karma
Get Updates on the Splunk Community!

Earn a $35 Gift Card for Answering our Splunk Admins & App Developer Survey

Survey for Splunk Admins and App Developers is open now! | Earn a $35 gift card!      Hello there,  Splunk ...

Continuing Innovation & New Integrations Unlock Full Stack Observability For Your ...

You’ve probably heard the latest about AppDynamics joining the Splunk Observability portfolio, deepening our ...

Monitoring Amazon Elastic Kubernetes Service (EKS)

As we’ve seen, integrating Kubernetes environments with Splunk Observability Cloud is a quick and easy way to ...