Solved

Windows event forwarding - is there a gpo to configure which events are forwarded?

Posted on 2008-10-04
5
1,397 Views
Last Modified: 2009-12-16
I did not find any word in the vista gpo reference about how to configure which events are forwarded to the eventlog server using a gpo. Did MS skip this?
To make it more clear: I can configure which server to send to by using a gpo but not which events to send while at the client I can do that manually.
0
Comment
Question by:CaptainAhab
5 Comments
 
LVL 5

Expert Comment

by:satyatech
ID: 22644119
Please visit:
http://blogs.technet.com/wincat/archive/2008/08/11/quick-and-dirty-large-scale-eventing-for-windows.aspx

Excerpts:
If Group Policy is not being used, configure the "Subscription type" to be "Collector Initiated". In this case Source Computers will need to be manually added to the Subscription either through the Subscription configuration or the "WECUTIL" command-line utility (which can also be scripted using PowerShell, but that's another topic).

Note: In cases where there Source Computer is generating a large volume of forwarded events (e.g. Security events from a Domain Controller), use WECUTIL on the collector to disable event rendering for the subscription. The task of pre-rendering an event on the source computer can be CPU intensive for a large number of events.
0
 
LVL 54

Expert Comment

by:McKnife
ID: 22644149
I know that page and that is not an answer to my question.
0
 

Author Comment

by:CaptainAhab
ID: 22645023
OK, again swapped accounts here...but anyway. Satyatech, that is not an answer to MY question :)
I found a solution that could be a workaround, so if others are interested, here it is:
--
1 Configure an event forwarding subscrition on your vista computer and call it sup1
2 copy the following file: c:\programdata\microsoft\event viewer\subscriptionfilters\sup1.xml and place it into the folder at the target computer
3 export the following regfile and import it at the target computer: HKLM\software\microsoft\windows\currentversion\eventcollector\subscriptions\sup1
4 execute the following command at the client (from an elevated command prompt):wecutil rs sup1
Done!

I will squeeze these commands and files and regkeys into an msi and distribute it - no problem.

I will keep this question open in case anyone could tell if MS has a GPO for it.
0
 
LVL 1

Accepted Solution

by:
Computer101 earned 0 total points
ID: 22858984
PAQed with points refunded (250)

Computer101
EE Admin
0

Featured Post

Simplifying Server Workload Migrations

This use case outlines the migration challenges that organizations face and how the Acronis AnyData Engine supports physical-to-physical (P2P), physical-to-virtual (P2V), virtual to physical (V2P), and cross-virtual (V2V) migration scenarios to address these challenges.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
Unable to ping a server in the same subnet 10 125
windows event log error 1000 DSM what does this mean? 5 63
Run Windows Server from USB 2 38
GPO reset 2 40
Scenario:  You do full backups to a internal hard drive in either product (SBS or Server 2008).  All goes well for a very long time.  One day, backups begin to fail with a message that the disk is full.  Your disk contains many, many more backups th…
I was supporting a handful of Windows 2008 (non-R2) 2 node clusters with shared quorum disks. Some had SQL 2008 installed and some were just a vendor application that we supported. For the purposes of this article it doesn’t really matter which so w…
This tutorial will show how to configure a new Backup Exec 2012 server and move an existing database to that server with the use of the BEUtility. Install Backup Exec 2012 on the new server and apply all of the latest hotfixes and service packs. The…
The Task Scheduler is a powerful tool that is built into Windows. It allows you to schedule tasks (actions) on a recurring basis, such as hourly, daily, weekly, monthly, at log on, at startup, on idle, etc. This video Micro Tutorial is a brief intro…

679 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question