Installation

Setting up to roll out forwarder "Add rights to the GPO" breaks windows 10 logon

Kucster
Engager

I'm working on rolling out the forwarder to all my companies clients and I found the "Prepare your Windows network to run Splunk Enterprise as a network or domain user" guide. I've gone through the steps but skipped "Change Administrators group membership on each host" , we do not have many hosts and I simply did it manually.

But after I apply the GPO to the clients the users are no longer able to logon, they simply get a black screen. I've confirmed if I disable the GPO they are able to logon just fine. I can't image any reason for this so any help would be greatly appreciated. I've attached a screen shot of the GPO I created and all our users are running Win 10 with the latest updates.

Example-9-29-2020.png

Labels (2)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Why run Splunk under a domain account?  The documentation at https://docs.splunk.com/Documentation/Splunk/8.0.6/Installation/ChoosetheuserSplunkshouldrunas#About... lists 4 reasons for using a domain account.  If you don't meet any of those requirements then you'll be much happier running Splunk under a local account.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

Why run Splunk under a domain account?  The documentation at https://docs.splunk.com/Documentation/Splunk/8.0.6/Installation/ChoosetheuserSplunkshouldrunas#About... lists 4 reasons for using a domain account.  If you don't meet any of those requirements then you'll be much happier running Splunk under a local account.

---
If this reply helps you, Karma would be appreciated.

Kucster
Engager

Thank you so much that worked much better

0 Karma
Get Updates on the Splunk Community!

BSides Splunk 2022 - The Call for Papers is now Open!

TLDR; Main Site: https://bsidessplunk.com CFP Site: https://bsidessplunk.com/cfp CFP Opens: December 15th, ...

Sending Metrics to Splunk Enterprise With the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...

What's New in Splunk Cloud Platform 9.0.2208?!

Howdy!  We are happy to share the newest updates in Splunk Cloud Platform 9.0.2208! Analysts can benefit ...