If your interested in the standard set of Event Logs/Active Directory/DNS/DHCP logs, then absolutely and it works well on everything up to and including Windows 2008R2. However, if you need to get any WMI data out of the servers, then consider using the splunk light weight forwarder and read the doc's on how to implement.
In my environment Windows Snare clients send tcp to a syslog-ng server on the same RHEL Linux box as Splunk resides. syslog-ng sends to Splunk and is the records manager for log retention. Snare client can be deployed via .exe or by .msi & group policy or via a third party tool like LANDesk. Need to make sure your Group Policy Auditing is tight and need to tweak the out of the box Snare objectives to get the detail you want. One advantage from my point of view is that logs from Snare are a single line syslog format and comingles well with CISCO data that I also retrieve/index.
