Getting Data In

How to install UF via GPO?

ask
Engager

Hi Team,

How to install UF via GPO?

Any specific command line  to run the file .msi that use our username and password?


Thanks and best regards,

Labels (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

The UF installation guide doesn't address GPO, but still should be helpful.  See https://docs.splunk.com/Documentation/Forwarder/8.1.3/Forwarder/InstallaWindowsuniversalforwarderrem...

---
If this reply helps you, Karma would be appreciated.

DuncanClarke
Engager

I tried following the instructions linked but have failed to upgrade successfully.

I am upgrading from 9.0.4 to 9.0.5 using a (startup) script with one line:

MSIEXEC.exe /i splunkforwarder.msi AGREETOLICENSE="yes" DEPLOYMENT_SERVER="servername:port" SPLUNKUSERNAME="admin" SPLUNKPASSWORD="password" /QUIET

However, nothing happens when I reboot the server and it stays at 9.0.4. Running the command in an elevated CMD it doesn't appear to do anything either. If however I remove the /QUIET it then runs through the installation (interactively) without any issues and upgrades to 9.0.5.

Please can you advise if I'm missing something to allow it to run non-interactively using the /QUIET flag?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

There's a note in latest version of the Forwarder Manual that may help https://docs.splunk.com/Documentation/Forwarder/latest/Forwarder/InstallaWindowsuniversalforwarderfr....

If you have enabled Windows auto run, Splunk installation might be failed when the auto run script is failed. As a workaround, you can use cmd /D msiexec.exe /i to install Splunk.
---
If this reply helps you, Karma would be appreciated.
0 Karma

DuncanClarke
Engager

For anyone else doing this, I have created a script which, when run as a startup script in a GPO, appears to work for us:

Computer Configuration -> Policies -> Windows Settings  -> Scripts -> Startup

REM Get the folder from which it was called
SET var=%~dp0
ECHO "%var%splunkforwarder.msi"

REM Install the MSI 
MSIEXEC.exe /i "%var%splunkforwarder.msi" AGREETOLICENSE="yes" DEPLOYMENT_SERVER="server:port" SPLUNKUSERNAME="username" SPLUNKPASSWORD="password" /QN

If you run this script with the latest splunkforwarder.msi in the same directory it should install or update as appropriate.

ask
Engager

Thank you @richgalloway , appreciate on this 😊

0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...