How to do it...

This recipe shows you how to forward events.

  1. Configure event collection on each server—first on DC1 (locally) then remotely to SRV1:
       wecutil qc /quiet | Out-Null       Invoke-Command -ComputerName SRV1 `                      -ScriptBlock {wecutil qc /quiet} | Out-Null
  1. Create the collector security group, add DC1:
      $ECGName='Event Collector Group'      New-ADGroup -Name $ECGName -GroupScope Global `                  -Path 'OU=IT,DC=Reskit,DC=Org'      Add-ADGroupMember -Identity $ECGName -Members'DC1$'
  1. Display membership of this new group:
      Get-ADGroupMember -Identity $ECGName
  1. Create a new GPO to configure event collection:
      $GPOName = 'Event Collection'      $ECGName = 'Event Collector Group'      $gpo  = New-GPO -Name $GPOName      $link = New-GPLink -Name $GPOName ` -Target "DC=Reskit,DC=Org" ...

Get Windows Server 2016 Automation with PowerShell Cookbook - Second Edition now with O’Reilly online learning.

O’Reilly members experience live online training, plus books, videos, and digital content from 200+ publishers.