Guide To Configuring Event Subscriptions In Server 2008

Written by Allen White on. Posted in SBS2008/2011, Server 2008

To set up a source initiated subscription that requires minimal intervention and no thought every time a new server is built, follow these easy steps.

Source computers

If you want to configure this as a one off, to test do the following:

On your source computer, using an elevated command prompt, enter the following:

winrm qc -q

Or if you are running in a domain environment, and want to set and forget:

  1. Open up your Group Policy Editor, and browse to (or create a new) GPO that will contain your settings (best bet here is to use a GPO already in place for your servers so that you don’t create load for each machine processing a million GPO’s!).
  2. Under the Computer Configuration node, expand the Administrative Templates node, then expand the Windows Components node, and then select the Event Forwarding node.
  3. Right-click the Subscription Manager setting, and select Properties. Enable the Subscription Manager setting, and click the Show button to add a server address to the setting. Add at least one setting that specifies the event collector computer. The Subscription Manager Properties window contains an Explain tab that describes the syntax for the setting.
  4. Now browse down the list a little way, and find the Windows Remote Management (WinRM) node, select the WinRM Service node, and find the “Allow Automatic Configuration of Listners” setting.
  5. Enable the setting, and then enter in an IP, IP range, or enter * into each of the IPv4 and IPv6 fields. Just use * if you aren’t concerned about security, or drill down to specifics if you are doing things by the book as you should be!
  6. Close out of the GP editor, and then just refresh the settings tab to make sure that everything is the way that you want it to be.

At this stage you can run gpupdate /force on your source servers, or just allow for the natural flow and wait for the next automatic refresh.

Collector Computer

Run the following command from an elevated privilege command prompt to configure Windows Remote Management:

winrm qc -q

Run the following command to configure the Event Collector service:

wecutil qc /q

You now have 2 options about how you create the subscription. You can either do this through the event viewer, or by using a script.

Via the Event viewer:

  1. Open up the event viewer, and select the subscriptions node. Right click, and select “Create Subscription”
  2. Give the subscription a name, and select “Source computer initiated”
  3. Select “Select Computer Groups” and enter it in domain computers, as per the example below.


4. If you are using certificates, select the one for your system, and select OK.

5.  Hit “Select events” and chose the event types and ID’s that you want to monitor, select OK, and if you are happy with your settings, select OK again.

Via a script

Copy the following code into your favourite text editor, and save it as configurationfile.xml

From the command line browse to the folder that you saved the above file in, and run:

wecutil cs configurationFile.xml


Allen White
Allen is a Consultant for ITPS in the North East of England and holds the following accreditations. MCSA, MCSE, MCTS, MCITP, CCA, CCSP, VCP 4,5 and HP ASE, AIS - Network Infrastructure.

ITPS provides strategic IT consultancy, implementation, data centre provision and unified communications, as well as support services and workspace and disaster recovery. If you require a consultation then please contact me via the contacts section or direct on 07931222991, add me on linkedin.

Related Problems

Server 2008 Can See PCs But PCs Cannot See Servers Or Authenticate
A solutionto to a problem where pcs` cannot log into a domain after updates to server 2008r2. This is a problem with the windows firewall.PC`s cannot see server 2008 ...
IT Tutorials
When your clients logon to your domain you can give them a nice greeting or a company policy notice. Read this guide on how to do so.
Step By Step Guide To Setup KMS Server
A guide on how to setup and configure microsoft KMS server. Step by step KMS server setup.Microsft KMS Server Guide
Find Out What User Is Logged Into A PC
A command that will help you find out what user is logged onto a pc/workstation on a network. How to find out who is logged into a pc.
Unable to open default email folders, the information store could not be opened..Problem signature: Problem Event Name: BEX
Outlook 2003 and terminal services or remote desktop services casues outlook to crash. The fix is to disable DEP.Problem signature: Problem Event Name: BEX Application Name: OUTLOOK.EXE Application Version: 11.0.8217.0 Application Timestamp: 480f95d9 Fault Module ...
Create or Remove A Static Route In A Windows OS
If you need to route traffic in windows this can be done with a command line toll. Here is how to create a static route in windows.
How To Enable SSL 3.0 Server 2008 /SBS 2008/SBS2011
SSL 3.0 is not enabled in server 2008/sbs2008 and sbs2011 out of the box. It can be enable from the registry however. Here is how to enable ssl 3.0.
IT Tutorials
If you are looking to upgrade your domain from server 2003 to server 2008 then there are a number of pre-requisites that need to be followed. Here is everything you ...
Server 2008 Can See PCs But PCs Cannot
Add a Logon Message to Server 2003,2008 and
Step By Step Guide To Setup KMS Server
Find Out What User Is Logged Into A
Unable to open default email folders, the information
Create or Remove A Static Route In A
How To Enable SSL 3.0 Server 2008 /SBS
Upgrade 2003 Domain to Server 2008


What Do You Think?

Search Solutions


(c) Please be aware, all information is provided freely, any information used is done so at your risk and Techieshelp will not be held responsible for any issue that may occur.