Security

add a domain admin account?

sullivanrl
New Member

My installation was installed as a Local System user, ( by someone else) but I'm tasked with setting it up and I really need a domain admin account to access other machines.

Can I add a domain admin account or do I need to re-install?

Tags (1)
0 Karma

JuergenRoth
New Member

Hello, this is my Problem, too!

I install Splunk on a Windows Server 2003 SP2. The user i'm taken is a domain-administrator. But with this account the both services don't start. I f i change the user (@services) to system account, it works. But i have no rights to reach other servers. Whats wrong here?

Juergen

0 Karma

eantonio
Path Finder

I used the Local System Account to install Splunk then I installed the License. After that, I was able to go to Services and change the account for splunkd and splunkweb to run as my Domain Admin account. I just need to change some permissions on the Splunk folder to give the Domain Admin account Full Control (C:\Program Files\Splunk\var\run)

0 Karma

darrenhutton
New Member

Try adding a non-admin account to the local Administrators group on your sever. See if the service will run under that account. You won't be able to gather off remote severs with this, but it will show if you've got an issue running the services under something other than Local System

0 Karma

eantonio
Path Finder

Hi,

I'm having the same issue. The installation doesn't work when I use a Domain Admin account. It only works when I use the Local System Account. My Domain Admin account is part of the Local Admin Group in the Splunk Server. Any idea what I am doing wrong?

0 Karma

dwaddle
SplunkTrust
SplunkTrust

As long as the NTFS permissions are suitable, you can change the Splunk services to run under a Domain Admin (or any other) service account. But, you should be on the look out for permissions-oriented problems.

Get Updates on the Splunk Community!

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars this month. This ...

They're back! Join the SplunkTrust and MVP at .conf24

With our highly anticipated annual conference, .conf, comes the fez-wearers you can trust! The SplunkTrust, as ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...