Question

On windows server, when you open group policy setting (gpedit.msc in System32), I can set up Event Forwarding by following steps here: http://msdn.microsoft.com/en-us/library/windows/desktop/bb870973(v=vs.85).aspx under section Configuring the event source computer

I was wondering if I could use PowerShell to do the same thing with setting up the Collector Address and Enabling the Subscription Manager Configuration (Steps 3 and 4 in the provided link under the specified section above).

I came across this doc: http://technet.microsoft.com/en-us/library/ee461027.aspx for group policy cmdlets but I am not sure how to use these cmdlets to do the same thing I can do by using the gpedit UI.

If you have any hints or good pointers on how to start or which cmdlets to use, I would appreciate that.

Thanks

Answer 1

you will find in another answer the roadmap to create a GPO based on a registry key on a W2K8 R2 computer using PowerShell.

To find thes you fave tochange have a look to : C:\Windows\PolicyDefinitions\EventForwarding.admx

<?xml version="1.0"?>
<policyDefinitions xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" revision="1.0" schemaVersion="1.0" xmlns="http://schemas.microsoft.com/GroupPolicy/2006/07/PolicyDefinitions">

        <policyNamespaces>
                <target prefix="eventforwarding" namespace="Microsoft.Policies.EventForwarding" />
                <using prefix="windows" namespace="Microsoft.Policies.Windows" />
        </policyNamespaces>

    <supersededAdm fileName="EventForwarding.adm"/>

    <resources minRequiredRevision="1.0"/>

    <categories>
        <category name="EventForwarding" displayName="$(string.EventForwarding)">
            <parentCategory ref="windows:WindowsComponents"/>
        </category>
    </categories>

    <policies>
        <policy name="SubscriptionManager" class="Machine" displayName="$(string.SubscriptionManager)" explainText="$(string.Subscription_Help)" presentation="$(presentation.SubscriptionManager)" key="Software\Policies\Microsoft\Windows\EventLog\EventForwarding">
            <parentCategory ref="EventForwarding"/>
                        <supportedOn ref="windows:SUPPORTED_WindowsVista" />  
            <elements>
                <list id="SubscriptionManager_Listbox" key="Software\Policies\Microsoft\Windows\EventLog\EventForwarding\SubscriptionManager" valuePrefix=""/>
            </elements>
        </policy>
        <policy name="ForwarderResourceUsage" class="Machine" displayName="$(string.ForwarderResourceUsage)" explainText="$(string.ForwarderResourceUsage_Help)" presentation="$(presentation.ForwarderResourceUsage)" key="Software\Policies\Microsoft\Windows\EventLog\EventForwarding">
            <parentCategory ref="EventForwarding"/>
                        <supportedOn ref="windows:SUPPORTED_WindowsVista" />  
                        <elements>
                                <decimal id="MaxForwardingRate" valueName="MaxForwardingRate"/>
                        </elements>
                </policy>
    </policies>

</policyDefinitions>