Hey man, Thanks for the quick reply, I've installed the UF on the DC. So i need to change some configs on the DC then under the Splunk folder to point back to the Splunk server? What changes need to be made, i'm guessing its that notepad file under the splunk /etc/system/local. I see outputs file is set to use my Splunk Server and DeploymentClient is pointing to Splunk server IP also. Service is running on DC and firewall rules checked also. Do i need to configure something else on the Splunk server that isn't the receiver landing page? In the Choose logs from this host field(under remote sources), when i chuck the IP of the DC in there it just keeps saying unable to get WMI classes from host. Do i even need to fill out this page? Under forwarder management it says " no clients or apps are currently available on this deployment server" Does that mean i need to install forwarder on the server too? ....and yes just some frustration there.  Cheers ... View more