Security

Splunk Enterprise upgrade to 9.4.0 failing - failing to set permissions

MMershon
Explorer

Hello,

 

Attempting to upgrade our test environment from 9.3.2 to 9.4.0 on Windows Server 2019 fails with the following message found in splunk.log:

<time>
C:\windows\system32\cmd.exe /c "C:\Windows\system32\icacls "C:\Program Files\Splunk" /grant "LocalSystem:(OI)(CI)(F)" /T /C >> "<out to %temp%\splunk.log>" 2>&1"


LocalSystem: No mapping between account names and security IDs was done.
Successfully processed 0 files;  Failed processing 1 files.

Seems pretty straightforward. Attempting to grant Full Access/Control to all files and subdirectories...
EXCEPT...

It almost certainly should be "NT AUTHORITY\System", not "LocalSystem".
Pretty sure this is just a Linux vs Windows nomenclature thing.

Are there any suggestions for forcing to permission as the correct account or do I need to open a support ticket to have this fixed in the next release?

Get Updates on the Splunk Community!

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...