none
Windows Event Collection Point of Sale

    Question

  • We are attempting to implement Windows Event Collection in a very secure environment.  In attempting to use a source initiated subscription, we are allowing 5985 outbound from a firewall to the WEC server, but, not inbound 5985.  

    the subscription appears fine both on the WEC server itself (green circle with arrow) and using the command line tools. Nevertheless, event logs are NEVER forwarded.  

    When using HTTP, does 5985 have to be allowed ingress and egress?  If so, is there any possible workaround?  We would prefer the WEC server not communicate with the terminals at all, but, only have the terminals forward their logs to the WEC.

    Thanks in advance for any assistance.

    Monday, December 08, 2014 8:49 PM

Answers