how will Splunk App for Active Directory scripts affect AD DC performance?

[L3on1d]

"Enable auditing and local PowerShell script execution on Active Directory servers"

Which scripts splunk runs on AD DC? How app will affect on the performance? Thanks.

[jbernt_splunk · Accepted solution]

Typically, the TA for DNSServer and DomainController (in the Addons directory inside the Splunk for AD app folder $SPLUNK_HOMEetcappsSplunk_for_ActiveDirectoryappserveraddons, will run the necessary PowerShell scripts for the inputs for each DNS and domain controller. The cpu may reach a few percent more when the PowerShell scripts are running due to the WMI calls they make, but you shouldn't notice much of a performance hit once the initial apps are deployed.
-Jeff