This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(195.2, 57.99999999999999%, 28%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EML%3C/text%3E%3C/svg%3E)
Hi everyone I have several servers and one server as a collector. All the logs are forwarded from these servers to the collector(to the Forwarded Events folder) Except for security logs(will forwarded to the Security folder) security logs like logon and logoff. How can i fix it? I would like to get some help. Thanks Michael
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(313.6, 55.00000000000001%, 40%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EHL%3C/text%3E%3C/svg%3E)
Hello, Thank you for posting in Q&A forum. To better understand the issue, if you can let me know how did you enable the log forwarding? Meanwhile, please kindly 1.Go to "Event Viewer" on the server, right-click on the Security log and select "Properties". 2.Click on the "Security" tab and go to "Advanced". 3.Check if the collector server is listed here. Best regards, Hania Lian
---If the Answer is helpful, please click "Accept Answer" and upvote it.
Hi Hania Lian Thanks for your response. I didn't find numbers 2 and 3. Can you take screenshots for me? I created "forwarded events" by these steps: 1)winrm service running on both sides(collector & computer/forwarder). 2)I created a listener for port 5986 & certificate on the collector server. 3)In GPO I created GP Object: configure target subscription-manager configure log access trusted hosts allow remote server management through Winrm 4) On the collector side: I created a subscription: I selected "source computer initiated" ( i added all my computers) In Events to collect : logged: any time event level: all checkboxes by log: app, security, setup, system. In configuring advanced settings: minimize latency protocol: https am I missing something? Thanks Michael