Hi
Is it the best way to install Universal Forwarders on all Workstations and enable windows security events , Right Now I have UF's on all DC's?
If your asking "is there value" in installing the UF on workstations the answer is almost certainly "yes"
But you should consider a few things first:
If your asking "is there value" in installing the UF on workstations the answer is almost certainly "yes"
But you should consider a few things first:
some thing related answer:
https://answers.splunk.com/answers/499611/how-to-monitor-remote-logs-in-a-centerized-heavy-f.html