Hi Splunkers, we have an environment where for Windows Logs collection it is higly desiderated to avoid agent installation. After some searches, we found that the proper way is to use WMI.
Now, what is not completely clear for us is the list of permission required for a Domain User; what we need is a short but esaustive list of permission for it.
Untile now, we know that this user must:
- Be a domain user
- Belong to Event Reader group
- Have access to system where to collect logs
- Be able to read at minimum System, Application and Security logs in case of AD DCs
- Be the user that execute the splunkd daemon for forwarder (HF or U, in our case HF) that must collect data with WMI
Is there any other requirements we are missing?
