diff --git a/Vagrant/bootstrap.sh b/Vagrant/bootstrap.sh
index ad9bf5f..47172d2 100644
--- a/Vagrant/bootstrap.sh
+++ b/Vagrant/bootstrap.sh
@@ -79,14 +79,15 @@ install_splunk() {
     echo "Splunk is already installed"
   else
     echo "Installing Splunk..."
-    # Get Splunk.com into the DNS cache. Sometimes resolution randomly fails during wget below
-    dig @8.8.8.8 splunk.com
+    # Get download.splunk.com into the DNS cache. Sometimes resolution randomly fails during wget below
+    dig @8.8.8.8 download.splunk.com > /dev/null
+    dig @8.8.8.8 splunk.com > /dev/null
     mkdir splunk
 
     # Try to resolve the latest version of Splunk by parsing the HTML on the downloads page
+    echo "Attempting to autoresolve the latest version of Splunk..."
     LATEST_SPLUNK=$(curl https://www.splunk.com/en_us/download/splunk-enterprise.html | grep -i deb | grep -Eo "data-link=\"................................................................................................................................" | cut -d '"' -f 2)
     # Sanity check what was returned from the auto-parse attempt
-    echo "Attempting to autoresolve the latest version of Splunk..."
     if [[ "$(echo $LATEST_SPLUNK | grep -c "^https:")" -eq 1 ]] && [[ "$(echo $LATEST_SPLUNK | grep -c "\.deb$")" -eq 1 ]]; then
       echo "The URL to the latest Splunk version was automatically resolved as: $LATEST_SPLUNK"
       echo "Attempting to download..."
diff --git a/Vagrant/resources/splunk_forwarder/wef_inputs.conf b/Vagrant/resources/splunk_forwarder/wef_inputs.conf
index 8673674..02e48bc 100755
--- a/Vagrant/resources/splunk_forwarder/wef_inputs.conf
+++ b/Vagrant/resources/splunk_forwarder/wef_inputs.conf
@@ -384,6 +384,33 @@ start_from = oldest
 current_only = 0
 checkpointInterval = 5
 
+[WinEventLog://WEC7-Active-Directory]
+sourcetype = WinEventLog:Security
+source = WinEventLog:Active-Directory
+index=wineventlog
+disabled = 0
+start_from = oldest
+current_only = 0
+checkpointInterval = 5
+
+[WinEventLog://WEC7-Terminal-Services]
+sourcetype = WinEventLog:Security
+source = WinEventLog:Terminal-Services
+index=wineventlog
+disabled = 0
+start_from = oldest
+current_only = 0
+checkpointInterval = 5
+
+[WinEventLog://WEC7-Privilege-Use]
+sourcetype = WinEventLog:Security
+source = WinEventLog:Privilege-Use
+index=wineventlog
+disabled = 0
+start_from = oldest
+current_only = 0
+checkpointInterval = 5
+
 [monitor://c:\pslogs]
 index = powershell
 sourcetype = powershell_transcript