Getting Data In

Universal forwarder Windows installation (x86 and x64) fails when being pushed by GPO; missing next button?

evilsaint
New Member

Testing this out on two separate machines in our environment as we need to get Splunk up and running on all server by this Friday. The installations process just fine when done manually, and uninstall as well without any errors, but when we try to push them via GPO (auto-install or assign via Computer Policy; publish, assign, or auto-install via User Policy), the application either fails to show up completely, or shows up in the Network Applications but fails to install due to the Next button just... not being there (screenshot attached).

I've gone through nearly every single option on the AD side, including recreating the policies wholesale, as well as re-downloading the .MSI files, and checked that this occurs on multiple servers within differing layers of GPO application, including some with nearly zero other policies being applied at all.

Would it be worth a shot at modifying/transforming the MSI or writing a script to have a GPO run the installers silently? Or does this potentially point to a larger issue in my environment between GP and these specific packages? We also have PDQ available to deploy these if necessary, but I wasn't able to find an EXE-version of the installer; just ZIP files.

Windows Server 2008 R2 DCs, 2008 non-R2 and Windows 7 SP1 member servers that we're trying to install the forwarders on. Splunk Enterprise, installed and working, but potentially not fully configured. Thanks in advance!

alt text

0 Karma

DavidHourani
Super Champion

Hi there,

What command are you using for the insall ?

Should be something like this :

msiexec.exe /i splunkuniversalforwarder_x86.msi LOGON_USERNAME="yourUser" LOGON_PASSWORD="yourPassword" AGREETOLICENSE=Yes /quiet

Hope that helps.

Cheers,
David

0 Karma

9eagles
Explorer

add AGREETOLICENSE=yes /quiet to the end of the command string.
More information about this located here http://docs.splunk.com/Documentation/Forwarder/7.2.0/Forwarder/InstallaWindowsuniversalforwarderfrom...

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...