Getting Data In

How to hide Splunk forwarder from add/remove programs list?

adam_jones
Engager

I am pushing the Splunk forwarder out to a bunch of workstations. I don't want users to be able to remove the forwarder once it's installed. I've noticed that on my workstation I can go into the Add/Remove programs list in Windows and uninstall it. Also, I can stop the service from running. Is there any way to hide the forwarder from these places so that users don't remove it? Some of the users will have local admin rights so I don't think I can take away their ability to uninstall, but if it's hidden it's more likely to stay around.

0 Karma

javiergn
SplunkTrust
SplunkTrust

Hi,

Take a look at this: http://www.winhelponline.com/articles/15/1/How-to-hide-an-entry-in-the-AddRemove-Programs-applet.htm...

With regards to the service start/stop, while you can't easily stop your local admins from starting/stopping the Splunk service on Windows, you can monitor what's going on periodically:

  • Monitor your System Event Logs and look for "Event Source: Service Control Manager" where description contains the name of the Splunk service. This will tell you when the service was stopped / started
  • Use Splunk On Splunk or the Distributed Management Console to monitor the status of your Universal Forwarders. There are built-in searches to list UFs not reporting after certain amount of time that you can tweak to customise your needs
  • If the number of Windows hosts you want to watch is not extremely huge you can always monitor the Splunk services remotely every minute or so by writing some basic PowerShell that either via WMI or built-in cmdlets keeps an eye on those services. A multithreaded approach is recommended here

But most importantly, there's something that really helped me in the past: get support from senior management on this. If someone senior enough informs your employees that stopping certain security/logging tools is not permitted unless there's a valid reason for it, people would think twice before doing so. It won't stop them but if they do, and you manage to find out, there will be consequences.

Hope that helps.

Thanks,
J

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...