Windows 7 Ent Workstation / Windows 2008 R2 Ent Server Event Collection Failure
i have setup collector (win 2008 r2 ent server) "winrm qc" , "wecutil /qc"
, source (win 7 ent workstation) "winrm qc"
added collector domain\hostname the workstation's "event log readers" , "administrators" in order connect w/out "access denied" error. security.evtx event log file has "event log readers" read access in sddl per "wecutil gl security" showing (a;;0x1;;;s-1-5-32-573). verified sid returned "wmic group (name='event log readers') name,sid". collector erroring on collection subscription code "0x138c" saying query returns no active channel. see login in source security event log collector successful first special privileges assigned logon , account logged in successfully. verified windows firewall exceptions opened inbound http:5985. thoughts why still failing? - sherman
hi,
>> i verified sid returned "wmic group (name='event log readers') name,sid". collector erroring on collection subscription code "0x138c" saying query returns no active channel.
please check link,it could helpful:
solving event log subscription error "0x138c"
________________________________________
best regards,
cartman
please remember mark replies answers if , unmark them if provide no help. if have feedback technet support, contact tnmff@microsoft.com.
Windows Server > Windows Server General Forum
Comments
Post a Comment