Use LOCAL_SYSTEM in place of USE_VIRTUAL_ACCOUNT for Windows UF 9.1.x installation from the command line

Applicability

Description

Splunk Universal Forwarder for Windows is configured with a virtual account for service since 9.1 by default.
This article described how to switch to the old manner to use LOCAL_SYSTEM account at installation, of a Windows universal forwarder from the command line.

Please note based on docs: About the least-privileged user

Running the universal forwarder as a local system account or domain user is not a security best practice, as it provides the user with a lot of high-risk permissions that are unnecessary for running the universal forwarder. When you install version 9.1 or later of the universal forwarder, the installer creates a virtual account as a "least privileged" user called splunkfwd, which provides only the capabilities necessary to run the universal forwarder.

You can read more about virtual account on MS docs page: Virtual accounts

Investigation

Based on the Splunk docs: Install a Windows universal forwarder from the command line

sample CLI for silent installation a Windows universal forwarder from the command line looks like below:

msiexec.exe /i splunkforwarder-9.1.2-b6b9c8185839-x64-release.msi LAUNCHSPLUNK=0 AGREETOLICENSE=Yes GENRANDOMPASSWORD=1 SERVICESTARTTYPE=auto /quiet

This is by default install the UF to run as VIRTUAL_ACCOUNT , refer to screenshot below:

Resolution

For silent installation, a Windows universal forwarder from the command line to use LOCAL_SYSTEM account (which is not a security best practice) looks like below:

msiexec.exe /i splunkforwarder-9.1.2-b6b9c8185839-x64-release.msi LAUNCHSPLUNK=0 AGREETOLICENSE=Yes GENRANDOM
PASSWORD=1 SERVICESTARTTYPE=auto USE_VIRTUAL_ACCOUNT=0 USE_LOCAL_SYSTEM=1 /quiet

by using flags: USE_VIRTUAL_ACCOUNT=0 USE_LOCAL_SYSTEM=1 

The results in services look like on the screenshot below:

Related Links

Virtual accounts
Install a Windows universal forwarder from the command line
About the least-privileged user
Install splunk forwarder via command prompt to run under virtual account
Supported commandline flags