Skip to content

Instantly share code, notes, and snippets.

@scotgabriel

scotgabriel/commandToPrepEventLogForwarding.ps1

Created May 2, 2018 21:51
Show Gist options
  • Save scotgabriel/68ec15633268a3f659427ea82397a770 to your computer and use it in GitHub Desktop.
Save scotgabriel/68ec15633268a3f659427ea82397a770 to your computer and use it in GitHub Desktop.
Download ZIP
Raw
commandToPrepEventLogForwarding.ps1
### Run on SOURCE computers
# from elevated command prompt
winrm quickconfig
# Collecting from DC(s)? Then you won't be able to modify local policy or local admin group, do this instead on each SOURCE
wevtutil sl security /ca:O:BAG:SYD:(A;;0xf0005;;;SY)(A;;0x5;;;BA)(A;;0x1;;;S-1-5-32-573)(A;;0x1;;;s-1-5-20)
### Run on COLLECTOR computer
#from elevated command prompt
wecutil qc
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment