The curl call that changes an app permission looks like :   curl -s -k -u admin:<ADMIN_PASSWORD> --request POST "https://localhost:8089//services/apps/local/<APP_NAME>/acl" -d sharing=global -d owner=nobody   The required sharing  parameter indicates how the resource is shared: sharing   app: Shared within a specific app global: (Default) Shared globally to all apps. user: Private to a user   The details are available here: REST API doc  ... View more

Hi Stefano, you have various possibilities depending on your security requirements and network infrastructure : using a Windows local forwarder, WMI, ... See http://docs.splunk.com/Documentation/Splunk/latest/Data/MonitorWindowsdata /dd ... View more