Change the user selected during Windows installation

You can change the Windows user that Splunk Enterprise or a universal forwarder has been installed as prior to starting the software for the first time.

The user that you change to must be a user that has administrative privileges on the local machine where you installed the software. See Choose the Windows user Splunk Enterprise should run as for additional information on choosing the correct Windows user for Splunk Enterprise operations.

There are several scenarios where performing this task is helpful:

• If you selected "Domain user" during the Splunk Enterprise installation, and that user does not exist or you mistyped the information
• If you need to install a Splunk Enterprise instance as a managed system account (MSA)
• If you installed the software from a ZIP file and want to change the Windows user for the Splunk Enterprise services from the default SYSTEM user

You must perform this procedure before you start Splunk Enterprise. If Splunk Enterprise has started, then stop it, uninstall it, and reinstall it.

1. Run the Services tool. From the Start menu, click Control Panel > Administrative Tools > Services.
2. Find the splunkd and splunkweb (or splunkforwarder for the universal forwarder) services. These services must not be started. The Local System user owns them by default.
3. Right-click a service, and select Properties.
4. Click the Log On tab.
5. Click the This account button.
6. Fill in the correct domain\user name and password.
7. Click Apply.
8. Click OK.
9. (Optional) If you run Splunk Enterprise in legacy mode, repeat steps 2 through 6 for the second service.
10. Start the Splunk Enterprise services from the Service Manager or from the command-line interface.