No announcement yet.

GPO Based Event Forwarding not working

  • Filter
  • Time
  • Show
Clear All
new posts

  • GPO Based Event Forwarding not working


    When i configure the collector based event forwaring, it does work like a charm. But when I configure the source based event forwarding, it does not work.
    Well, its test environment so its the same forwarder and same collector where my collector based event forwarding works(already ran winrm and wecutil).

    In domain based source computer I have gone to local group policy(not domain gpo) of the member Source computer (2008r2,not a domain controller)
    Last edited by naubahi; 26th April 2012, 03:26.

  • #2
    Re: GPO Based Event Forwarding not working

    Not working again. There must be something that I am missing. Please help.
    Last edited by naubahi; 3rd May 2012, 19:29.


    • #3
      Re: GPO Based Event Forwarding not working

      Thanks for posting back!
      Tom Jones
      MCT, MCSE (2000:Security & 2003), MCSA:Security & Messaging, MCDBA, MCDST, MCITP(EA, EMA, SA, EDA, ES, CS), MCTS, MCP, Sec+
      PhD, MSc, FIAP, MIITT
      IT Trainer / Consultant
      Ossian Ltd

      ** Remember to give credit where credit is due and leave reputation points where appropriate **


      • #4
        Re: GPO Based Event Forwarding not working

        Originally posted by Ossian View Post
        Thanks for posting back!

        it is again not working. I really need a solution so bad. Please help. Here is what I did.I please need help. Sorry for posting back


        I keep getting into problems in GPO based event forwarding(source inititated). Sometimes it works, Sometimes it does not. The problem I have to run manually winrm quickconfig on all computers. Whereas the gpo should do it automatically. I still get
        Winrm is not set to allow remote access to this machine for management so for this reason, I have to run winrm quickconfig manaually on all computers.Why my following gpo settings are not enabling it

        I have done so far following steps

        configured gpo linked to domain as

        Computer Configuration/Policies/Administrative Templates/Windows Components/Event Forwarding

        configure server address setting as


        Computer Configuration/Policies/Administrative Templates/Windows Components/windows remote management/winrm service
        Allow automatic configuration of listeners
        ipv4 *
        ipv6 *


        Computer Configuration\Policies\Windows Settings\Security Settings\System Services
        Windows Remote Management(ws-management service) >>set it to automatic start

        Another gpo settting as

        Comp config/windows settings/security settings/windows firewall with advanced security/inbound rule

        allowed port 5985
        Allowed predefined windows remote management
        allow predefined windows remote event log management