none
How would I force an "Applications and Services Log" to be enabled via GPO?

    Question

  • Okay, so my scenario is that I found out in 2012 R2 there is a new way of logging DNS client requests in Event Viewer, and I'm hoping to collect DNS requests from a bunch of Domain Controllers via Event Forwarding.  I'm familiar with Event forwarding so that's not a problem, but I wasn't sure how to force the settings for one of the entries in the "Applications and Services logs" in Event Viewer through GPO.  Has anyone done this before?  I'm assuming we're probably looking at GP Preferences and not GPO right?
    Monday, November 21, 2016 5:34 PM

All replies

  • Hi,

    Okay, so my scenario is that I found out in 2012 R2 there is a new way of logging DNS client requests in Event Viewer, and I'm hoping to collect DNS requests from a bunch of Domain Controllers via Event Forwarding.  I'm familiar with Event forwarding so that's not a problem, but I wasn't sure how to force the settings for one of the entries in the "Applications and Services logs" in Event Viewer through GPO.  Has anyone done this before?  I'm assuming we're probably looking at GP Preferences and not GPO right?

    >>>To clarify, what do you want to do is that you want to configure event forwarding one entry under Application and Services Logs by group policy. Right?

    If yes, to configure which entry need be forwarded, you need configure the Subscriptions like below. And as far as I know there is no such setting in group policy.

    For events forwarding, there are only two settings about it.

    Configure forwarder resource usage

    This policy setting controls resource usage for forwarder (source computer) by controlling the events/per second sent to the Event Collector.

    Configure target Subscription Manager

    This policy setting allows you to configure the server address refresh interval, and issuer certificate authority(CA) of a target subscription manager.

    Best Regards,

    Jay


    Please remember to mark the replies as answers if they help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    Wednesday, November 23, 2016 7:51 AM
    Moderator