Setting up to roll out forwarder "Add rights to the GPO" breaks windows 10 logon

[Kucster]

I'm working on rolling out the forwarder to all my companies clients and I found the "Prepare your Windows network to run Splunk Enterprise as a network or domain user" guide. I've gone through the steps but skipped "Change Administrators group membership on each host" , we do not have many hosts and I simply did it manually.

But after I apply the GPO to the clients the users are no longer able to logon, they simply get a black screen. I've confirmed if I disable the GPO they are able to logon just fine. I can't image any reason for this so any help would be greatly appreciated. I've attached a screen shot of the GPO I created and all our users are running Win 10 with the latest updates.

[richgalloway · Accepted solution]

Why run Splunk under a domain account?  The documentation at https://docs.splunk.com/Documentation/Splunk/8.0.6/Installation/ChoosetheuserSplunkshouldrunas#About... lists 4 reasons for using a domain account.  If you don't meet any of those requirements then you'll be much happier running Splunk under a local account.

[Kucster]

Thank you so much that worked much better