Security

How to permanently remove accounts remaining after removing passwd file?

a212830
Champion

Hi,

I am in the process of rebuilding my dev environment, and am taking over an existing search-head that wasn't being used. I upgraded to 6.1.3, and then renamed the passwd file, so that all the old accounts were removed. However, there are still a number of ldap-based accounts appearing, and if I try to delete them via the gui, a message appears saying that "user account does not exist". Is there another place where they need to be removed from? I looked in the passwd file, and they are not present.

Tags (2)

hsesterhenn_spl
Splunk Employee
Splunk Employee

As far as I understand the docs directories in etc/users are automatically created as long as you can successfully log in via LDAP.

HTH,

Holger

0 Karma
Get Updates on the Splunk Community!

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

Splunk Enterprise Security 8.x: The Essential Upgrade for Threat Detection, ...

Watch On Demand the Tech Talk on November 6 at 11AM PT, and empower your SOC to reach new heights! Duration: ...

Splunk Observability as Code: From Zero to Dashboard

For the details on what Self-Service Observability and Observability as Code is, we have some awesome content ...