Problem with forwarding event log for single node

Question

I have configured the forwarding of event logs to a dedicated server on my network. Subscription in collector initiated mode.

I encountered an error accessing event logs on one of the servers. Windows Server 2019 is installed on this server.

The following error is registered on the collector's server:

Code (0x80338126): WinRM cannot complete the operation. Verify that the specified computer name is valid, that the computer is accessible over the network, and that a firewall exception for the WinRM service is enabled and allows access from this computer. By default, the WinRM firewall exception for public profiles limits access to remote computers within the same local subnet.

On the source server, I checked the firewall settings. The necessary ports are open.

I also checked that the test of the winrm command on the collector server does not pass:

C:\Windows\system32>winrm id -r:idc07
WSManFault
    Message = WinRM cannot complete the operation. Verify that the specified computer name is valid, that the computer is accessible over the network, and that a firewall exception for the WinRM service is enabled and allows access from this computer. By default, the WinRM firewall exception for public profiles limits access to remote computers within the same local subnet.

Error number:  -2144108250 0x80338126
WinRM cannot complete the operation. Verify that the specified computer name is valid, that the computer is accessible over the network, and that a firewall exception for the WinRM service is enabled and allows access from this computer. By default, the WinRM firewall exception for public profiles limits access to remote computers within the same local subnet.

The server is pinged from the collector server. And it has rdp access.

I don't understand what else could be the problem.

Answer 1

Hello

You may consider following these steps to perform some basic checks: 

1.Ensure that WinRM service status is set to "Running," and its startup type is "Automatic."

2.Verify that WinRM is listening on the expected port. By default, it should listen on port 5985 for HTTP or 5986 for HTTPS.

Thanks,

Karlie