Remove PCs from Source-Initiated Windows Event Forwarding?

Question

I've Googled this and haven't found any answers.

(yep, I also posted on TechNet about this)

I have a few workstations that have been decommissioned and are showing as "Inactive". I'd like to remove them from the subscription to minimize the appearance of errors.

The answer here was for Collector-Initiated setups, (which requires you to run C++ code??).

Has anyone found an easy way to remove SOURCE-INITIATED PCs?

Answer 1

Check out the "registry size" note on this page.

For each unique device that connects to a WEF subscription, there is a registry key (corresponding to the FQDN of the WEF Client) created to store bookmark and source heartbeat information. If this is not pruned to remove inactive clients this set of registry keys can grow to an unmanageable size over time.

It's as easy as deleting the registry key on the Windows Event Collector server. You could write a script to compare the list of clients in the registry with the list of active clients in your active directory. Then delete the keys for clients that do not exist in AD or haven't authenticated in a while.

These keys are located here on each of your Windows Event Collector servers: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\EventCollector\Subscriptions\<SubscriptionName>

Answer 2

There is a windows command to manage subscriptions, wecutil.exe.

https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/wecutil

wecutil ss "Event subscription name" /res /esa:eventsourcecomputername.domain.com  

Answer 3

try this:

Get-ChildItem HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\EventCollector\Subscriptions\your-subscription-name-here\EventSources|%{
    try{
        $path=$_.Name.Replace("HKEY_LOCAL_MACHINE","HKLM:")
        $bookmark=Get-ItemPropertyValue -Path $path -Name bookmark
        if ($bookmark.length -eq 0){
            Remove-Item -Path $path
            }
        }
    catch{
        Remove-Item -Path $path
        }