The biggest problem with Event Viewer is that it can be really confusing – there are a lot of warnings, errors, and informational messages, and without knowing what it all means, you can assume (incorrectly) that your computer is broken or infected when there’s nothing really wrong.
Let’s start by enabling Win RM on the source domain controller (DC).
In this article, I’ll show you how to set up Event Log forwarding in Windows Server 2012 R2, configuring a source server, and another that acts as a collector.
Windows Server 2008 and Vista or later can be configured as event collectors, while Windows Server 2003 Service Pack 1 and Windows XP Service Pack 2 or later are supported sources.
Event logs provide historical information that can help you track down system and security problems.
The event-logging service controls whether events are tracked on Windows 2000 systems.