Note: This question is part of a series of questions that present the same scenario. Each question in
the series contains a unique solution. Determine whether the solution meets the stated goals.
A user named User1 is a member of the local Administrators group on Computer1 and Computer2.
User1 fails to access the Event Viewer logs on Computer 2 from Computer 1.
User1 can connect to Computed remotely by using Computer Management.
You need to ensure that User1 can use Event Viewer on Computer1 to remotely view the Event Viewer logs on
Computer 2.
Solution: You run winrm quick config on Comparer2.
Does this meet the goal?
A.
Yes
B.
No
No that command is only to enable the Remote Management Service. It takes more configuration to open events from another computer.
https://www.loggly.com/ultimate-guide/centralizing-windows-logs/
answer is indeed no
the answer is yes believe me
the answer is no believe me
it is yes
To use the event-collecting feature, you must configure the forwarding and the collecting computers. The event-collecting functionality depends on the Windows Remote Management (WinRM) service and the Windows Event Collector service (Wecsvc). Both of these services must be running on computers that are participating in the forwarding and collecting process.
Enabling subscriptions
To enable subscriptions, perform the following steps:
On each source computer, to enable Windows Remote Management, type the following command at an elevated command prompt, and then press Enter:
winrm quickconfig
2. On the collector computer, to enable the Windows Event Collector service, type the following command at an elevated command prompt, and then press Enter:
wecutil qc
3. Add the computer account of the collector computer to the local Event Log Readers group on each of the source computers.
Tomar, the reason that I selected no and don’t validate your reasoning is: winrm is ALREADY enabled or USER1 would not be able to connect to the Computer2. Winrm /qc would not configure anything that hasn’t already been configured. Someone correct me if I’m wrong, please?
*Tomer, sorry, that wasn’t on purpose.
As I read this, the answer would be “no”.
We’ve gotten a bit off topic in the discussion. If we wanted to view Computer2’s events via subscription on Computer1, tomer would be 100% correct. The question isn’t asking us to do that. The task is to open event viewer on Computer1 and view the events on Computer2. To do that, you would:
1) Open Event Viewer
2) Right-click on “Event Viewer (local)”
3) Chose “Connect to Another Computer” in the menu.
4) Enter Computer2’s IP or Hostname in the box.
A prerequisite to this would be to ensure that you’re a Local Admin on the remote computer (stated in the question) and to make sure to “enable the Remote Event Log Management exception in the Windows Firewall Settings on the remote computer to which you want to connect.”
Source: https://technet.microsoft.com/en-us/library/cc766438(v=ws.11).aspx