I want to keep the Windows Remote Registry service turned off on my Windows machines. I decided to use Splunk to monitor the service and see if anything turns it on. It turns out that Splunk is actually turning on and off the service throughout the day. This is probably because I'm using WinRegMon to monitor the registry.
Does Splunk actually require the Remote Registry service? Or is this something I can disable? I was wondering why Splunk turns the service on for remote use when the Splunk forwarder is installed locally on the Windows machine.
Here is an example of what I have in my inputs.conf:
[WinRegMon://RegistryMonitor]
baseline = 0
disabled = 0
hive = HKEY_USERS\\.*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\\.*
proc = C:\\.*
type = rename|close|set|delete|open|create|query
