Harden the Splunk Enterprise installation directory on Windows

If you choose to install Splunk Enterprise in a directory that is outside of the Windows Program Files application directory on the drive that booted your Windows machine, that installation directory does not get the automatic protections that directories inside the Program Files directory receive.

Follow these instructions to ensure that Windows enforces the proper access controls to the Splunk software installation directory and that low-privilege users cannot access that directory.

Harden Splunk software installation directories with Windows Explorer

1. From an Explorer window, right click on the target installation folder and select Security > Advanced > Disable Inheritance > Remove all inherited permissions from this object.
2. Click Add > Select a principal > Administrator > Check Names.
3. Click OK.
4. Click Check full control.
5. Click OK.
6. Click Add > Select a principal > SYSTEM > Check Names.
7. Click OK.
8. Click Check full control.
9. Click OK.
10. Click Apply. then click OK

Harden Splunk software installation directories from a PowerShell window or command prompt

These instructions were tested and work as described on Windows versions 8.1 and higher, and Window Server versions 2008 R2 and 2012 R2. As an example, this procedure uses C:\Splunk as the installation directory.

1. Open a command prompt or PowerShell window.
2. Run the following command to break inheritance from parent directories.
   

   C:\>icacls C:\Splunk /inheritance:d
   

3. Run the following command to remove the Users group from the directory.
   

   C:\>icacls C:\Splunk /remove "Users" /T
   

4. Run the following command to remove the "Authenticated Users" group from the directory.
   

   C:\>icacls C:\Splunk /remove "Authenticated Users" /T