Security Event Forwarding Server 2008

[Guest TheMazz]

Hi Guys,

 

Is it possible to forward the 'Security' Event Log using a standard

collector based initiated subscription? I have successfully forwarded the

System & Application logs, however when trying to forward the Security log, I

receive the following error:

 

Error Code (0x32): <f:ProviderFault provider="Event collector plugin for

Windows Remote Management " path="%systemroot%\system32\wevtfwd.dll"

xmlns:f="http://schemas.microsoft.com/wbem/wsman/1/wsmanfault"><t:ProviderError

xmlns:t="http://schemas.microsoft.com/wbem/wsman/1/windows/EventLog">Windows

Event Forward Plugin failed to create

subscription.</t:ProviderError></f:ProviderFault>

 

I think I read somewhere that there is additional security placed on the

security log. Both the collector and the initialor are DC's.

 

Thanks,

Andrew

[Guest PA Bear [MS MVP]]

[[Forwarded to WinServer General & WinServer Security newsgroups via

crosspost.]]

 

TheMazz wrote:<span style="color:blue">

> Is it possible to forward the 'Security' Event Log using a standard

> collector based initiated subscription? I have successfully forwarded the

> System & Application logs, however when trying to forward the Security

> log,

> I receive the following error:

>

> Error Code (0x32): <f:ProviderFault provider="Event collector plugin for

> Windows Remote Management " path="%systemroot%system32wevtfwd.dll"

> xmlns:f="http://schemas.microsoft.com/wbem/wsman/1/wsmanfault"><t:ProviderError

> xmlns:t="http://schemas.microsoft.com/wbem/wsman/1/windows/EventLog">Windows

> Event Forward Plugin failed to create

> subscription.</t:ProviderError></f:ProviderFault>

>

> I think I read somewhere that there is additional security placed on the

> security log. Both the collector and the initialor are DC's.

>

> Thanks,

> Andrew </span>