Hello, in ou're environment we've configured the forwarders (Windows, version 6.6.3) to use a gMSA account to run the splunkd service. This account has been granted the correct permissions (as described in the installation documentation).
After an (expected) restart on some systems the service won't startup correctly (Eventid 7000, The SplunkForwarder service failed to start due to the following error:
The service did not start due to a logon failure.)
When this issue arrises, the Test-ADServiceAccount returns a true value. The PrincipalsAllowedToRetrieveManagedPassword properties has been configured with the correct systems that use the gMSA account.
A manual restart will fix this issue. offcourse, this can be trapped within a monitoring solution, or with an action combined to this event, but this is working around an issue imho. What's the best way to troubleshoot/fix this issue.
... View more