So the issue of the driver signature has come up before.
Im not too sure why it happens but one possibility is with 64bit machines and the driver not passing the signing.
Another possibility is if you already have one instance of splunk running and the regmon is already being monitored.
Since this is a light forwarder then you cannot use splunkweb to disable the monitoring. What is needed is to change this in the configuration files:
Go to C:\Program Files\Splunk\etc\system\local\inputs.conf
And add this:
[script://$SPLUNK_HOME\bin\scripts\splunk-regmon.path]
disabled = 1
Once done, a splunk restart is all that is needed.
Cheers
.gz
