Getting Data In

Does the Windows Active Directory user for Splunk forwarder need "Remote Desktop access" rights?

realsplunk
Motivator

Hello,

Does the Windows user for Splunk forwarder need "Remote Desktop access" rights?

In general, what kind of Windows user/role/rights is recommended?

Thanks.

0 Karma
1 Solution

kmorris_splunk
Splunk Employee
Splunk Employee

Take a look here (excerpt on choosing the Windows user below):
https://docs.splunk.com/Documentation/Forwarder/6.5.3/Forwarder/InstallaWindowsuniversalforwarderfro...

Choose the Windows user that the universal forwarder should run as
When you install the universal forwarder, you can select the Windows user that the forwarder uses to get data. You have two choices.

Local System. If you specify the Local System user during the installation process, the universal forwarder collects any kind of data that is available on the local host. It cannot collect data from other hosts.
Domain account. This option installs the forwarder as the Windows user you specify. The forwarder has the permissions that have been assigned to that user, and collects data that the user has read access to. It does not collect data from resources that the Windows user does not have access to. If you need to collect data from those resources, you must give the Windows user access to those resources.
Install the forwarder as a Domain account to do any of the following:

Read Event Logs remotely
Collect performance counters remotely
Read network shares for log files
Access the Active Directory schema, using Active Directory monitoring
Choose and configure the user that the universal forwarder should run as before installing the forwarder for remote Windows data collection. If you do not, installation can fail.

If you install as a domain user, specify a user that has access to the data you want to monitor. See Choose the Windows user Splunk should run as in the Splunk Enterprise Installation Manual for concepts and procedures on the user requirements that must be in place before you collect remote Windows data.

If you install as a domain user, you can choose whether or not the user has administrative privileges on the local machine. If you choose not to give the user administrative privileges, the universal forwarder enables "low-privilege" mode. See Install the universal forwarder in low-privilege mode.

View solution in original post

kmorris_splunk
Splunk Employee
Splunk Employee

Take a look here (excerpt on choosing the Windows user below):
https://docs.splunk.com/Documentation/Forwarder/6.5.3/Forwarder/InstallaWindowsuniversalforwarderfro...

Choose the Windows user that the universal forwarder should run as
When you install the universal forwarder, you can select the Windows user that the forwarder uses to get data. You have two choices.

Local System. If you specify the Local System user during the installation process, the universal forwarder collects any kind of data that is available on the local host. It cannot collect data from other hosts.
Domain account. This option installs the forwarder as the Windows user you specify. The forwarder has the permissions that have been assigned to that user, and collects data that the user has read access to. It does not collect data from resources that the Windows user does not have access to. If you need to collect data from those resources, you must give the Windows user access to those resources.
Install the forwarder as a Domain account to do any of the following:

Read Event Logs remotely
Collect performance counters remotely
Read network shares for log files
Access the Active Directory schema, using Active Directory monitoring
Choose and configure the user that the universal forwarder should run as before installing the forwarder for remote Windows data collection. If you do not, installation can fail.

If you install as a domain user, specify a user that has access to the data you want to monitor. See Choose the Windows user Splunk should run as in the Splunk Enterprise Installation Manual for concepts and procedures on the user requirements that must be in place before you collect remote Windows data.

If you install as a domain user, you can choose whether or not the user has administrative privileges on the local machine. If you choose not to give the user administrative privileges, the universal forwarder enables "low-privilege" mode. See Install the universal forwarder in low-privilege mode.

realsplunk
Motivator

Thanks kmorris, could you confirm Remote Desktop access is not required then as we only index local files/registry?

0 Karma

kmorris_splunk
Splunk Employee
Splunk Employee

No, you would not need Remote Desktop access for that user.

Get Updates on the Splunk Community!

Using Machine Learning for Hunting Security Threats

REGISTER NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more ...

Security Highlights | November 2022 Newsletter

 November 2022 2022 Gartner Magic Quadrant for SIEM: Splunk Named a Leader for the 9th Year in a RowSplunk is ...

Platform Highlights | November 2022 Newsletter

 November 2022 Skill Up on Splunk with our New Builder Tech Talk SeriesCan you build it? Yes you can! *play ...