I'm installing Splunk Universal Frowarder using the following command: choco install splunk-universalforwarder --version=9.0.5 --install-arguments='DEPLOYMENT_SERVER=<server_address>:<server_port>' This install a SplunkForwarder service that runs with the user NT SERVICES/SplunkForwarder. Reading the documentation, this account is a virtual account which are managed local accounts.  Despite being described as managed local accounts, the documentation also states that "Services that run as virtual accounts access network resources by using the credentials of the computer account in the format <domain_name>\<computer_name>$."  Currently, my windows machines are joined to the AD Domain but I'm working to change it and to not join them to the AD in the future. I have a couple questions here: Can I use this default user (NT SERVICES/SplunkForwarder) even without joining the VM to the AD domain ? What are the limitations that I will face changing from this NT SERVICES account to a local account ? Thanks. ... View more