- in the command prompt run “winrm quickconfig” and the press y when prompted to enable the WinRM service & the firewall exception. (On the end user machine)
2. Open “Computer Management” > “System Tools” > “Local Users & Groups” > “Groups”. Then select “Event Log Readers”. Click “Add”, Choose the required object types by selecting “Object Types” (for this example I will be adding my ADDC machine). After that enter the Machine or account name and then select “OK”. Then click “Apply” and “OK”. (On the end user machine)
3. Open the “Event Viewer” (On the server)
4. Go to “Subscription” & click “Yes” (On the server)
5. Right click on “Subscriptions” and the select “Create Subscription”.(On the server)
6. Here provide a “Name” & “Description” for the Subscription. Then Select the destination for the log in the “Destination Log” field. (On the server)
7. Go to “Select Computers” and then “Add Domain Computers”. (On the server)
8. Enter the “Computer Name” & click “OK”. (On the server)
9. Select the Computer and click on “Test”. once the test is succeeded then click “OK”. (On the server)
10. Go to “Select Events”, select the Required “Event Level” and the “Event Logs” and then click “OK”. (On the server)
11. Go to “Advanced”, Select the “Account”, “Event Delivery Optimization”, Protocol and the Port Number (I will be using the machine acc., Normal Delivery optimization, HTTP Protocol and Port 5985 for this example). Then select “OK”. (On the server)
12. Right click the subscription and to go “Runtime Status”, Make sure the machine status is “Active”, and wait for 15 min. After 15 mins, the logs should start coming in the chosen tab (Forwarded Events in this example). (On the server)
