Re: Security Event Forwarding Server 2008

[[Forwarded to WinServer General & WinServer Security newsgroups via
crosspost.]]

TheMazz wrote:
> Is it possible to forward the 'Security' Event Log using a standard
> collector based initiated subscription? I have successfully forwarded the
> System & Application logs, however when trying to forward the Security
> log,
> I receive the following error:
>
> Error Code (0x32): <f:ProviderFault provider="Event collector plugin for
> Windows Remote Management " path="%systemroot%\system32\wevtfwd.dll"
> xmlns:f="http://schemas.microsoft.com/wbem/wsman/1/wsmanfault"><t:ProviderError
> xmlns:t="http://schemas.microsoft.com/wbem/wsman/1/windows/EventLog">Windows
> Event Forward Plugin failed to create
> subscription.</t:ProviderError></f:ProviderFault>
>
> I think I read somewhere that there is additional security placed on the
> security log. Both the collector and the initialor are DC's.
>
> Thanks,
> Andrew