Hotspot Question Your network contains an Active Directory domain. The domain contains a domain controller named DC1 and a server named Server1 that runs Windows Server. You need to enable event log…

This question tests knowledge of Windows Event Forwarding (WEF), specifically which command enables the Windows Event Collector service and on which machines it must run to forward events from a source computer (DC1) to a collector computer (Server1).

Monitor and troubleshoot Windows Server environments

Question

Hotspot Question Your network contains an Active Directory domain. The domain contains a domain controller named DC1 and a server named Server1 that runs Windows Server. You need to enable event log subscriptions to forward events from DC1 to Server1. Which command should you run to enable the Windows Event Collector service, and on which servers should you run the command? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

Explanation

Approach. To enable event log subscriptions, you must run 'winrm quickconfig' on the SOURCE computer (DC1) to enable the Windows Remote Management service, which allows events to be sent. You must run 'wecutil qc' (Quick Config) on the COLLECTOR server (Server1) to enable and start the Windows Event Collector (WecSvc) service. The command 'wecutil qc' is the specific command that enables the Windows Event Collector service, and it must be run on Server1 (the collector). 'winrm quickconfig' enables WinRM on DC1 (the source/forwarder) so it can forward events.

Concept tested. Windows Event Forwarding (WEF) setup - understanding the role of 'wecutil qc' (enables Windows Event Collector on the collector server) vs 'winrm quickconfig' (enables WinRM on the source/forwarder server), and which command runs on which server (DC1 = source, needs WinRM; Server1 = collector, needs wecutil qc).

Reference. Microsoft Docs: Configure Computers to Forward and Collect Events (https://docs.microsoft.com/en-us/windows/win32/wec/setting-up-a-source-initiated-subscription)

Topics

#Event Forwarding#Windows Event Collector#Server Monitoring#PowerShell Command

Community Discussion

No community discussion yet for this question.

Full AZ-801 Practice