Forwarding Events from Windows Server 2008 Server Core DC
There were some changes between Windows Server 2008 and Windows Server 2008 R2, the one I am interested in is WinRM. The default HTTP port on Windows Server 2008 is TCP 80, but on Windows Server 2008 R2 the default HTTP port is TCP 5985. There are a couple of ways to get around this: either change the listener port on the Windows Server 2008 machine, or use a Collector Initiated subscription and change the port on the Advanced tab. In my example these computers are both Domain joined. Setting this up in a Workgroup environment is a little different and I may write up something for that later.
Configuring the Source (Windows Server 2008 Core)
Verify that the WinRM is either on or off
winrm e winrm/config/listener
http://lh4.ggpht.com/-20UxCCZEtYc/T986AkNGVqI/AAAAAAAABuE/6Zd_c4h1NY4/20100922-SourceWinRMDisabled_thumb.png
Here you can see that WinRM is not configured. So now we need to enable WinRM
winrm qc
http://lh3.ggpht.com/-H39AGkxjlqg/T986BZE-gFI/AAAAAAAABuU/3OjoLF6cEYo/20100922-SourceWinRMEnabled_thumb.png
The quickconfig (qc) option does the initial configuration of WinRM. It creates an HTTP listener on port 80, and enables firewall exceptions. In order to connect from the Collector and start getting events we also need to allow the remote administration service through the firewall.
netsh firewall set service type=remoteadmin mode=enable
http://lh6.ggpht.com/-_8jo11J-tDw/T986BhyIWBI/AAAAAAAABuk/rVrYi5aqUOg/20100922-SourceFirewallExceptionsOn_thumb.png
The configuration of the source server is done.
Configuring the Collector (Windows Server 2008 R2)
In order for this server to pull information from the Source you will need to setup a subscription
Start > Administrator Tools > Server Manager > Diagnostics > Event Viewer > Subscriptions
http://lh6.ggpht.com/-LvtMAb_eBdA/T986CEZKGtI/AAAAAAAABuw/yMtCvT4IJ-0/20100922-CollectorEnableWCESVC_thumb.png
You will notice that before you can setup a Subscription you need to enable the Windows Event Collector Service, click Yes. Now you can click Create Subscription from the Action pane on the right. At the very least you will need a Subscription name.
http://lh4.ggpht.com/-2L_LRb-vGEs/T986C3d1fUI/AAAAAAAABvE/2yIK7cbLzpY/20100922-CollectorSubscriptionProperties_thumb.png
We are going to configure a Collector initiated subscription, so browse the Directory and find your Source server. If you click the Test button, you may receive an error message that lets you know the Collector can’t talk to the Source. That’s ok, we’re going to fix that in a minute.
http://lh5.ggpht.com/-x759jWq6q_U/T986DB1tX5I/AAAAAAAABvU/9FjjlZ_2_RQ/20100922-CollectorSubscriptionError_thumb.png
Now we need to configure the list of Events that we are interested in. These are the default events available on any 2008 computer, you can write an XML query that you can paste into the XML tab.
http://lh5.ggpht.com/-PTEn3TRNxa0/T986DziWgkI/AAAAAAAABvg/ga0o5l7rO0c/20100922-CollectorSubscriptionEvents_thumb.png
The last thing we need to configure is the Protocol settings and Delivery Optimizations. If your Source server is not a Domain Controller then you can add the computer account of the Collector to the Local Administrators group on the Source. If your Source server is a Domain Controller, you may want to use a Service Account.
I set my Event Delivery Optimization to Minimize Latency, this ensures that events are delivered with minimal delay. If you are collecting events from the Security log, this may not be a setting you want to enable.
Finally the Protocol section, here you can change the HTTP port to 80.
http://lh3.ggpht.com/-4FVddy__CI8/T986EYyWz6I/AAAAAAAABvw/r80vOPl-r_0/20100922-CollectorSubscriptionAdvancedProperties_thumb.png
After a few minutes you should start to see events showing up under Forwarded Events.
http://lh4.ggpht.com/-4PhITKx8Ebg/T986Feqn19I/AAAAAAAABwE/Jk8Mi_H4SYo/20100922-CollectorForwardedEvents_thumb.png
