Can we configure windows event source for a domain user over http without using kerberos authentication ?

[shubhrangshuC]

We have a windows 2012R2 DC edition server which we are trying to integrate with our RSA SA 10.6.1.The user is a domain user.How can we configure the same on our VLC for the event source.Please help us clarify the following points :-

1. What is the Authorization method needs to be set as Basic or Authenticate ?

2. Event source address should be the IP address or FQDN(full computer name) of the event source ?

3. Any additional changes needs to be made on the CLI of VLC for integration ?

4. What ports needs to be opened on the firewall to complete this integration apart from 5985/TCP ?

5. What would be the task which needs to be performed by the AD/Domain Controller team ?

6. Any documentation with reference to the above points will be highly appreciated ?

7. We have already referred the documents of MicrosoftWindowsEventing,WinRM Configuration Guide & WinRM Troubleshooting Guide without much success.

[SravanKoneti1]

HI Subrangshu,

If you are not going for Kerberos authentication, Basic authentication method has to be used in Collection config page.

In windows server, verify Basic authentication enabled or not using command winrm get winrm/config

If Basic authentication is not yet enabled, enable it using winrm set winrm/config/service/auth @{Basic="true"}

If you still have issues, Please post errors in /var/log/messages relevant to event source.