Active Directory Project (Home Lab) | Troubleshooting

Summary

This troubleshooting video for an Active Directory project guides viewers through common errors encountered during setup and configuration. It covers critical steps such as installing Windows Server, ensuring proper network communication with Splunk, configuring the Splunk Forwarder service, and resolving domain joining issues. The video emphasizes verifying DNS settings, managing DHCP addresses, and ensuring data forwarding to Splunk is set up correctly. Additionally, it addresses necessary configurations for CI Linux and highlights the importance of correct password settings. Viewers are encouraged to share their challenges for collaborative problem-solving.

Takeaways

• 🔧 Ensure to check 'Skip unintended installation' when installing Windows Server to avoid errors with Microsoft software license terms.
• 🌐 Verify network connectivity by pinging the Splunk server's IP address to ensure proper communication.
• 📄 Use the correct inputs.comom file for data flow to Splunk, which can be downloaded from GitHub.
• 🔄 Restart the Splunk forwarder service and confirm it is set to use the local system account.
• 🏷️ When joining a domain, input the full domain name, including the top-level domain (e.g., df.loc).
• 📡 Check that the DNS settings in the network adapter are pointing to the correct domain controller IP address.
• ⚙️ If DHCP fails to assign an IP address, consider manually setting a static IP address for the virtual machine.
• 📊 Confirm that the endpoint index exists in Splunk; create it if it is missing.
• 🔈 Ensure that the Splunk server is set to receive data on port 9997 and configure a new port if necessary.
• ⏳ Be patient as data may take a few minutes to appear in Splunk after configuration changes.

Q & A

What should I check if I encounter an error stating that Windows cannot find the Microsoft software license terms during installation?

You must check the 'Skip unintended installation' option when installing Windows Server.

How can I verify if my Windows Server is communicating with the Splunk server?

Open Command Prompt and use the ping command to test connectivity to the Splunk server's IP address, for example, `ping 192.168.10.1`.

What steps should I take if my Windows Server is not forwarding logs to Splunk?

Ensure that you are using the correct inputs.conf file, restart the Splunk Forwarder service, and check that it is running under the Local System Account.

What is required to join a Windows Server to a domain successfully?

You need to enter the full domain name, including the top-level domain, and ensure that your DNS settings in IPv4 point to your domain controller's IP address.

What should I do if my network adapter is not obtaining a DHCP address?

Manually set a static IP address and try again, as sometimes VirtualBox may not assign a DHCP address correctly.

What steps are involved in setting up a receiving port on the Splunk server?

Go to Settings, then Forwarding and Receiving, and ensure that your Splunk server is listening on Port 9997. If it is not listed, create a new receiving port with this number.

Why might data not appear in Splunk immediately after configuration?

Data may take a few minutes to appear in Splunk after it has been configured, especially if there are delays in processing the events.

What should I do to prepare my Linux environment for using Crowbar?

Update and upgrade your repositories before attempting to install Crowbar, and ensure that Remote Desktop Protocol (RDP) is enabled on your target machines.

How should I manage the password used for accessing Crowbar?

Ensure that the password is correctly listed in the password.txt file before running Crowbar. Update the file with your specific password if needed.

What should I do if I encounter errors not mentioned in the troubleshooting video?

You can leave your questions or errors in the comments, and the community or creator may assist you in working through those issues.