Hi @JJ_Splunk , yes, the best approach to collect Domain Controller logs is to install a Universal Forwarder on the DC. Then you should install on the DC and on the Search Head the Splunk_TA-Windows add-on (https://splunkbase.splunk.com/app/742) Then you should configure it on the DC. Instead, if you want to exract AD structure and data, you should install on the HF the Splunk Supporting Add-On for Active Directory (https://splunkbase.splunk.com/app/1151) and connect it to the AD. Ciao. Giuseppe ... View more