I've got a Server Core 2016 installation I'm trying to configure as an event log collector. I've successfully enabled the firewall rules, however, when I connect to event viewer remotely through MMC, I can't see the subscriptions node. It seems that subscriptions can't be configured through MMC remotely

Since there's no PowerShell way of creating persistent subscriptions, how can this be configured on server core? It seems it requires the GUI installed


Subscriptions can be created manually with wecutil. To create a remote subscription using event viewer, first configure the subscription remotely, then export it using wecutil gs [subscription name] /f:xml. The subscription can be imported using wecutil cs [subscription.xml]. There are a few caveats:

  • At the time of writing, you must remove the XML declaration from the generated config file
  • The generated config file will use <ConfigurationMode>Normal</ConfigurationMode>. This should be changed to custom to avoid generating a warning. This is because a <Delivery> node is created. If you leave the value as Normal, remove the <Delivery> tag. The values are mutually exclusive. See here.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.