diff --git a/manifests/params.pp b/manifests/params.pp
index 233042cd..98485b56 100644
--- a/manifests/params.pp
+++ b/manifests/params.pp
@@ -159,8 +159,8 @@
       $enterprise_seed_config_file     = "${enterprise_homedir}/etc/system/local/user-seed.conf"
       $forwarder_password_config_file  = "${forwarder_homedir}/etc/passwd"
       $enterprise_password_config_file = "${enterprise_homedir}/etc/passwd"
-      $forwarder_secret_file           = "${forwarder_homedir}/etc/splunk.secret"
-      $enterprise_secret_file          = "${enterprise_homedir}/etc/splunk.secret"
+      $forwarder_secret_file           = "${forwarder_homedir}/etc/auth/splunk.secret"
+      $enterprise_secret_file          = "${enterprise_homedir}/etc/auth/splunk.secret"
       $forwarder_confdir               = "${forwarder_homedir}/etc"
       $enterprise_src_subdir           = 'linux'
       $enterprise_confdir              = "${enterprise_homedir}/etc"
@@ -191,8 +191,8 @@
       $enterprise_seed_config_file     = "${enterprise_homedir}/etc/system/local/user-seed.conf"
       $forwarder_password_config_file  = "${forwarder_homedir}/etc/passwd"
       $enterprise_password_config_file = "${enterprise_homedir}/etc/passwd"
-      $forwarder_secret_file           = "${forwarder_homedir}/etc/splunk.secret"
-      $enterprise_secret_file          = "${enterprise_homedir}/etc/splunk.secret"
+      $forwarder_secret_file           = "${forwarder_homedir}/etc/auth/splunk.secret"
+      $enterprise_secret_file          = "${enterprise_homedir}/etc/auth/splunk.secret"
       $forwarder_confdir               = "${forwarder_homedir}/etc"
       $enterprise_src_subdir           = 'solaris'
       $enterprise_confdir              = "${enterprise_homedir}/etc"
@@ -223,8 +223,8 @@
       $enterprise_seed_config_file     = "${enterprise_homedir}/etc/system/local/user-seed.conf"
       $forwarder_password_config_file  = "${forwarder_homedir}/etc/passwd"
       $enterprise_password_config_file = "${enterprise_homedir}/etc/passwd"
-      $forwarder_secret_file           = "${forwarder_homedir}/etc/splunk.secret"
-      $enterprise_secret_file          = "${enterprise_homedir}/etc/splunk.secret"
+      $forwarder_secret_file           = "${forwarder_homedir}/etc/auth/splunk.secret"
+      $enterprise_secret_file          = "${enterprise_homedir}/etc/auth/splunk.secret"
       $forwarder_confdir               = "${forwarder_homedir}/etc"
       $enterprise_src_subdir           = 'freebsd'
       $enterprise_confdir              = "${enterprise_homedir}/etc"
@@ -244,8 +244,8 @@
       $enterprise_seed_config_file     = "${enterprise_homedir}\\etc\\system\\local\\user-seed.conf"
       $forwarder_password_config_file  = "${forwarder_homedir}\\etc\\passwd"
       $enterprise_password_config_file = "${enterprise_homedir}\\etc\\passwd"
-      $forwarder_secret_file           = "${forwarder_homedir}\\etc\\splunk.secret"
-      $enterprise_secret_file          = "${enterprise_homedir}\\etc\\splunk.secret"
+      $forwarder_secret_file           = "${forwarder_homedir}\\etc\\auth\\splunk.secret"
+      $enterprise_secret_file          = "${enterprise_homedir}\\etc\\auth\\splunk.secret"
       $forwarder_service               = 'SplunkForwarder'
       $forwarder_service_file          = "${forwarder_homedir}\\dummy" # Not used in Windows, but attribute must be defined with a valid path
       $forwarder_confdir               = "${forwarder_homedir}\\etc"
diff --git a/spec/classes/enterprise_spec.rb b/spec/classes/enterprise_spec.rb
index 2c8f1d8b..e16f57e1 100644
--- a/spec/classes/enterprise_spec.rb
+++ b/spec/classes/enterprise_spec.rb
@@ -34,7 +34,7 @@
   it { is_expected.to contain_splunk_input('default_splunktcp').with(section: 'splunktcp://:9997', value: 'dns') }
   it { is_expected.to contain_splunk_web('splunk_server_splunkd_port').with(value: '127.0.0.1:8089') }
   it { is_expected.to contain_splunk_web('splunk_server_web_port').with(value: '8000') }
-  it { is_expected.not_to contain_file('/opt/splunk/etc/splunk.secret') }
+  it { is_expected.not_to contain_file('/opt/splunk/etc/auth/splunk.secret') }
   it { is_expected.not_to contain_file('/opt/splunk/etc/passwd') }
 end
 
@@ -121,7 +121,7 @@
           let(:params) { { 'manage_password' => true } }
 
           it { is_expected.to compile.with_all_deps }
-          it { is_expected.to contain_file('/opt/splunk/etc/splunk.secret') }
+          it { is_expected.to contain_file('/opt/splunk/etc/auth/splunk.secret') }
           it { is_expected.to contain_file('/opt/splunk/etc/passwd') }
         end
       end
diff --git a/spec/classes/forwarder_spec.rb b/spec/classes/forwarder_spec.rb
index f7be0aa3..f1f9cd0a 100644
--- a/spec/classes/forwarder_spec.rb
+++ b/spec/classes/forwarder_spec.rb
@@ -34,7 +34,7 @@
           it { is_expected.to contain_file('C:\\Program Files\\SplunkUniversalForwarder/etc/system/local/transforms.conf') }
           it { is_expected.to contain_file('C:\\Program Files\\SplunkUniversalForwarder/etc/system/local/web.conf') }
           it { is_expected.to contain_file('C:\\Program Files\\SplunkUniversalForwarder/etc/system/local/server.conf') }
-          it { is_expected.not_to contain_file('C:\\Program Files\\SplunkUniversalForwarder/etc/splunk.secret') }
+          it { is_expected.not_to contain_file('C:\\Program Files\\SplunkUniversalForwarder/etc/auth/splunk.secret') }
           it { is_expected.not_to contain_file('C:\\Program Files\\SplunkUniversalForwarder/etc/passwd') }
         else
           it { is_expected.to contain_package('splunkforwarder').with(ensure: 'installed') }
@@ -46,7 +46,7 @@
           it { is_expected.to contain_file('/opt/splunkforwarder/etc/system/local/transforms.conf') }
           it { is_expected.to contain_file('/opt/splunkforwarder/etc/system/local/web.conf') }
           it { is_expected.to contain_file('/opt/splunkforwarder/etc/system/local/server.conf') }
-          it { is_expected.not_to contain_file('/opt/splunkforwarder/etc/splunk.secret') }
+          it { is_expected.not_to contain_file('/opt/splunkforwarder/etc/auth/splunk.secret') }
           it { is_expected.not_to contain_file('/opt/splunkforwarder/etc/passwd') }
         end
         it { is_expected.to compile.with_all_deps }
@@ -64,7 +64,7 @@
             let(:params) { { 'manage_password' => true } }
 
             it { is_expected.to compile.with_all_deps }
-            it { is_expected.to contain_file('/opt/splunkforwarder/etc/splunk.secret') }
+            it { is_expected.to contain_file('/opt/splunkforwarder/etc/auth/splunk.secret') }
             it { is_expected.to contain_file('/opt/splunkforwarder/etc/passwd') }
           end
         end