Hi,
Am I imagining things, or does the Splunk TA_Windows automatically get installed with the UFW? Is there any way to stop that? It appears to automatically turn on some events, which I don't want (nor do I want to manually override them)...
Currently, if you install the UF with the MSI installer - it will install Splunk_TA_windows on your forwarder by default. The workaround for this (not installing TA_windows with the UF install) is to use the command line install option and perform a silent install of the forwarder.
You could also try to "customize" the install (with MSI installer) and not accept the defaults - if you do not select any input options, it is possible that TA_windows will not get installed, but I'm not 100% sure on this one. Feel free to test this one out.