Solved

Splunk Active Directory Add-on

Posted on 2015-02-13
6
354 Views
Last Modified: 2015-02-13
Hi,
I have just installed splunk enterprise, I want to monitor windows data etc.
I installed the Add-on for active director App and the windows app and am trying to configure them. I have opened the AD App and have started configuring using the wizard. I have entered the following parameters:
Domain name = mydomain.ie
Alternate Domain name = mydomain
LDAP Server:
                  Hostname = ip address of domain controller
                  port = 389
                  ssl = blank
Credentials:
                  Bind DN = mydomain\domain admin username
                  Password = Domain admin user password

When I hit test I get an error:
could not access the directory service at ldap://DC IP Address:389 ldapinvalidcredentialsresult - 49 - invalidcredentials - none - 80090308: ldaperr: dsid-0c0903a9, comment: acceptsecuritycontext error, data 52e, v1db0 - bindresponse - none"

I some time also get an error stating the Alternate domain name is in the domain please correct,

Any ideas what I am doing wrong here, the splunk documentation is not very helpful for a novice

Thanks
0
Comment
Question by:padraic Carron
  • 4
  • 2
6 Comments
 
LVL 35

Accepted Solution

by:
Joseph Daly earned 500 total points
ID: 40608021
From the info you you posted up it looks like your Bind DN is incorrect. Distinguished names normally take the form of.

CN=username,OU=People,DC=domain,DC=com

The easiest way to get the correct DN is to use ADSI edit and browse to the account you want to use, select it, right cick and choose properties. You will want to copy the distinguished name field.
0
 
LVL 35

Expert Comment

by:Joseph Daly
ID: 40608024
Actually heres an even easier way to get your DN. From any computer with Microsoft AD powershell cmdlets installed run the following command

get-aduser {admin username}  | select-object distinguishedname
0
 

Author Comment

by:padraic Carron
ID: 40608302
Thanks that seemed to work, but when I go to save it fails on the Alternate domain name.
I have put in the paramaters:
Domain name = mydomain.ie
Alternate Domain = mydomain
The error is "This domain is in use by the mydomain.ie"
0
Forrester Webinar: xMatters Delivers 261% ROI

Guest speaker Dean Davison, Forrester Principal Consultant, explains how a Fortune 500 communication company using xMatters found these results: Achieved a 261% ROI, Experienced $753,280 in net present value benefits over 3 years and Reduced MTTR by 91% for tier 1 incidents.

 
LVL 35

Expert Comment

by:Joseph Daly
ID: 40608330
I'm not too familiar with the product you are using but my two suggestions would be.

1. You may not need the additional domain name.

2. It may be referring to your DNS domain name versus your netbios domain name.

I would try number 1 first.
0
 

Author Comment

by:padraic Carron
ID: 40608504
I just put in a dummy name and it seemed to work ???
0
 
LVL 35

Expert Comment

by:Joseph Daly
ID: 40608582
You probably don't need it.
0

Featured Post

Secure Your Active Directory - April 20, 2017

Active Directory plays a critical role in your company’s IT infrastructure and keeping it secure in today’s hacker-infested world is a must.
Microsoft published 300+ pages of guidance, but who has the time, money, and resources to implement? Register now to find an easier way.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

A project that enables an administrator to perform actions within a user session context not just at the time of login but any time later on day(s) or week(s) later.
A company’s centralized system that manages user data, security, and distributed resources is often a focus of criminal attention. Active Directory (AD) is no exception. In truth, it’s even more likely to be targeted due to the number of companies …
This tutorial will walk an individual through the process of configuring their Windows Server 2012 domain controller to synchronize its time with a trusted, external resource. Use Google, Bing, or other preferred search engine to locate trusted NTP …
In this tutorial you'll learn about bandwidth monitoring with flows and packet sniffing with our network monitoring solution PRTG Network Monitor (https://www.paessler.com/prtg). If you're interested in additional methods for monitoring bandwidt…

733 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question