Windows Event Forwarding

Question

Windows Event Forwarding

shotaemon 0

I am trying to configure Windows Event Forwarding -source initiated event forwarding- using two Windows Server 2016 Version 1607 computers(Source) and Windows Server 2019 Version 1809. I completed the following steps, but it seems collector server doesn't connect to source computer. It shows that the source computer is 0 on the event viewer window. Could you tell me why this problem occurs?

▶Source Computer(Winndows Event Forwarding)

ⅰ. I have already configured group policy object that configure Subscription Manager.

▶Log Collecting Computer(Windows Event Collector)

ⅰ. I have already configure the Subscription Manager to collect the log from Source Computer.

Using command, wecutil qc, I confirmed that WinRM is properly setup.

1 answer

Your answer

Answer 1

Hello shotaemon,

Thank you for posting in Q&A forum.

Here are a few things you can check to troubleshoot this problem:

Ensure that the firewall on both the source and collector computers is configured to allow the necessary traffic. You need to allow inbound and outbound traffic on port 5985 (HTTP) or 5986 (HTTPS) for Windows Remote Management (WinRM).
Verify that WinRM is properly configured and running on both the source and collector computers. You can check the WinRM service status by running the following command in an elevated Command Prompt:

winrm quickconfig

sure that the Group Policy settings for event forwarding are correctly configured. You need to configure the Configure target Subscription Manager policy on the source computers to point to the collector server. The policy path is:

Computer Configuration > Administrative Templates > Windows Components > Event Forwarding > Configure target Subscription Manager

Double-check the subscription configuration on the collector server. Ensure that the subscription is set to Source initiated and that the source computers are correctly specified.
Ensure that there is no network connectivity issues between the source and collector computers. You can test connectivity by using the ping command to verify that the source computers can reach the collector server and vice versa.
Verify that the account used for event forwarding has the necessary permissions to read the event logs on the source computers and to write to the event logs on the collector server.

I hope the information above is helpful.

If you have any questions or concerns, please feel free to let us know.

Best Regards,

Daisy Zhou

============================================

If the Answer is helpful, please click "Accept Answer" and upvote it.

shotaemon 0 Reputation points

2025-03-14T09:02:21.1566667+00:00

Hi, Daisy Zhou.

Thank you for answering my question.

I appreciate it.

I have some questions with regard to the answer you mentioned above.

ⅰ. Both computers, Source computer and Collect computer, have already joined the domain. Does Group Policy Setting have to be set on the local group policy?
Now, it is configured by the domain group policy.

ⅱ. With regard to the answer you mentioned to me above, You told me that you should verify that the account used for event forwarding has the necessary permissions to read the event logs on the source computers. Could you tell me specifically what permissions do I have to grant to the account used for event forwarding ?

That's all, and I'm so sorry for my poor English.

Share via

Windows Event Forwarding

1 answer

Your answer