Configure the Source Computer

Install the WinRM on Source Computers

When the down-level machines are source computers, ensure that the WinRM client is installed on these machines.

We recommend you use a software distribution server to deploy the WinRM packages, such as System Center Configuration Manager (SCCM) or Systems Management Server (SMS).

When upgrading an event collector from WinRM 1.1 to WinRM 2.0, ensure there are no active subscriptions running, otherwise the upgrade may fail.

For more information, please see Prerequisites for Event Centralization Implementations.

Configure the WinRM Service

For source computers to communicate with the event collector machine, the Windows Remote Management (WinRM) service must be running on the source computers. WinRM service auto start is necessary for the host to retrieve subscription information from event collectors and send/push event data to the event collector.

The following Group Policy setting is used to configure WinRM to support event forwarding:

Computer Configuration\Policies\Windows Settings\Security Settings\System Services

Configuration Steps:

  1. Navigate to the Windows Remote Management (WS-Management) service.
  2. Double-click the service.
  3. Check Define this policy setting.

Turn on Windows Remote Management for the source computer.

  1. Select the Automatic radio button.


  1. Click OK.