Getting Data In

Options on installing universal forwarders on "Windows Machines"

ranjitbrhm1
Communicator

Hello All, Im a bit confused with the installation of a UF on the windows machine. According to the documents, there are 2 methods to install splunk UF. One with the local account and one with the domain account. Now, My question is lets say im setting it up on a "web server" , Should i select local account or domain account to pull the web server logs, in this case the iis logs. Also what excatly do they mean when they say one can monitor logs from other domain account as well if it is provided with a domain username and password? Is it like i have a server and there are multiple people logging on to that "specific server" also if i install it as a domain user, will it not collect the system logs by default? Also importantly just by installing a UF on 1 server with domain credentials does it mean i dont have to install UF on all the servers?

0 Karma
1 Solution

FrankVl
Ultra Champion

Let's go one by one:
Q: Should i select local account or domain account to pull the web server logs, in this case the iis logs.?
A: That does not so much depend on which logs you want to collect. It is more of a security decision to be made. Installing splunk to run under local system account is simple at install time and will usually mean you won't have to do much work to get it access to all kinds of logs on the machine. Using a domain account will allow you to run splunk with less privileges (so reducing some risks of a vulnerability in Splunk being abused to gain admin access on that machine), but is a bit more hassle to set up and manage.

Q: Also what excatly do they mean when they say one can monitor logs from other domain account as well if it is provided with a domain username and password?
A: Where exactly did you get this from? I don't think I completely understand this question.

Q: also if i install it as a domain user, will it not collect the system logs by default?
A: a normal, unprivileged domain user may not have access to the windows event logs by default, this is some of the extra effort you need to put in when using a domain account.

Q: Also importantly just by installing a UF on 1 server with domain credentials does it mean i dont have to install UF on all the servers?
A: No, it does not. While it is possible to remotely monitor windows hosts using WMI, this is typically not recommended and requires the use of a Heavy Forwarder, not a UF: http://docs.splunk.com/Documentation/Splunk/latest/Data/ConsiderationsfordecidinghowtomonitorWindows...

View solution in original post

0 Karma

FrankVl
Ultra Champion

Let's go one by one:
Q: Should i select local account or domain account to pull the web server logs, in this case the iis logs.?
A: That does not so much depend on which logs you want to collect. It is more of a security decision to be made. Installing splunk to run under local system account is simple at install time and will usually mean you won't have to do much work to get it access to all kinds of logs on the machine. Using a domain account will allow you to run splunk with less privileges (so reducing some risks of a vulnerability in Splunk being abused to gain admin access on that machine), but is a bit more hassle to set up and manage.

Q: Also what excatly do they mean when they say one can monitor logs from other domain account as well if it is provided with a domain username and password?
A: Where exactly did you get this from? I don't think I completely understand this question.

Q: also if i install it as a domain user, will it not collect the system logs by default?
A: a normal, unprivileged domain user may not have access to the windows event logs by default, this is some of the extra effort you need to put in when using a domain account.

Q: Also importantly just by installing a UF on 1 server with domain credentials does it mean i dont have to install UF on all the servers?
A: No, it does not. While it is possible to remotely monitor windows hosts using WMI, this is typically not recommended and requires the use of a Heavy Forwarder, not a UF: http://docs.splunk.com/Documentation/Splunk/latest/Data/ConsiderationsfordecidinghowtomonitorWindows...

0 Karma

ranjitbrhm1
Communicator

Think i read something else. I understand now. Thanks.

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to November Tech Talks, Office Hours, and Webinars!

🍂 Fall into November with a fresh lineup of Community Office Hours, Tech Talks, and Webinars we’ve ...

Transform your security operations with Splunk Enterprise Security

Hi Splunk Community, Splunk Platform has set a great foundation for your security operations. With the ...

Splunk Admins and App Developers | Earn a $35 gift card!

Splunk, in collaboration with ESG (Enterprise Strategy Group) by TechTarget, is excited to announce a ...