To direct Windows event sources to a collector, enable Configure target Subscription Manager in a source-computer Group Policy Object (GPO) and add the collector endpoint to its SubscriptionManagers list. That setting tells sources where to request subscription details; it does not configure the collector or create the subscription, so those steps must be completed separately.
Choose source-initiated or collector-initiated forwarding
Windows Event Forwarding supports two subscription models. In a source-initiated subscription, source computers are configured to contact a collector, often through Group Policy, and the subscription does not need to enumerate every source. In a collector-initiated subscription, the subscription specifies the event sources. The steps below cover the source-initiated model. See Microsoft’s overview of the Windows Event Collector for the distinction.
As an Amazon Associate I earn from qualifying purchases.
Configure the source-computer GPO
-
Open or create a GPO linked to the organizational unit containing the source computers.
Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy. -
In Group Policy Management Editor, go to Computer Configuration > Administrative Templates > Windows Components > Event Forwarding.
-
Open Configure target Subscription Manager, select Enabled, and add the collector entry in the setting’s SubscriptionManagers list. Microsoft describes the policy as configuring the server address and refresh interval; its HTTPS syntax can also include the issuer CA for client authentication. See the ADMX_EventForwarding Policy CSP.
-
Apply the policy to the source computers. Microsoft’s source-initiated setup uses
gpupdate /forceto refresh policy on a computer.
Use the correct Subscription Manager value
Microsoft documents this HTTPS entry format:
Server=https://<FQDN of the collector>:5986/wsman/SubscriptionManager/WEC,Refresh=<refresh interval in seconds>,IssuerCA=<thumbprint of the client authentication certificate>
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Replace each placeholder with the values for your deployment. In particular, do not paste the placeholder certificate thumbprint. The policy reference specifies port 5986 for HTTPS and 5985 for HTTP. For an HTTP entry, use the collector’s HTTP endpoint and port as appropriate; HTTPS adds the issuer CA thumbprint to the documented value. Select transport and authentication settings to match the certificates and configuration in your environment.
Microsoft says that enabling this policy lets a source computer contact a specific FQDN or IP address and request subscription details. The refresh value controls how often the source refreshes its subscription-manager information; use an interval appropriate to your deployment rather than copying an unexplained example value.
Complete the source and collector setup
The GPO is only the source’s pointer to a collector. Microsoft’s source-initiated subscription procedure separately covers source-side WinRM, policy application, collector configuration, and creation of the subscription.
-
On each source, configure WinRM. Microsoft’s procedure includes running
winrm qc -qfrom an elevated command prompt.Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy. -
Configure the source-computer GPO and apply it, as described above.
-
On the collector, configure WinRM and the Windows Event Collector service.
-
Create a source-initiated subscription on the collector. Microsoft documents using Event Viewer,
wecutil, or a programmatic method.
For a deployment of Microsoft Defender for Identity, Microsoft’s event-forwarding setup also uses this policy to direct domain controllers to a collector. That guidance is specific to that product deployment, not a universal extra requirement for Windows Event Forwarding.
Recommended Free Tools
Check policy applicability for your Windows versions
The Microsoft Policy CSP page lists SubscriptionManager applicability for Windows 10 version 2004 with KB5005101 and later listed releases, and Windows 11 version 21H2 and later. This is the applicability stated for that CSP policy documentation, not a complete compatibility matrix for every Group Policy environment. Verify that the policy template and target operating systems in your environment support the setting.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
