The content you are looking for has been archived. View related content below.
Sep 16 09:32:58 VLC NwLogCollector[15403]: [WindowsCollection] [failure] [windowshost] Bookmarks received: Application=204,Security=1,System=108
Sep 16 09:32:58 VLC NwLogCollector[15403]: [WindowsCollection] [failure] [windowshost] [processing] [WorkUnit] [processing] Remote event source [windowshost] has returned bookmark as '1' for one or more channels which maye be an error.Discarding pulled events and reverting bookmarks for all channels to previous known bookmarks.
winrm quickconfig wevtutil gl security > securityevtorig.txt
name: security
enabled: true
type: Admin
owningPublisher:
isolation: security
channelAccess: O:BAG:SYD:(A;;0xf0007;;;SY)(A;;0x7;;;BA)(A;;0x3;;;BO)(A;;0x5;;;SO)(A;;0x1;;;IU)(A;;0x3;;;SU)(A;;0x1;;;S-1-5-3)(A;;0x2;;;S-1-5-33)
logging:
logFileName: %SystemRoot%\System32\Winevt\Logs\security.evtx
retention: false
autoBackup: false
maxSize: 16777216
publishing:
fileMax: 1
wevtutil sl security /ca:existing-SDDL-string(A;;0x1;;;S-1-5-32-573)Example:
wevtutil sl security /ca:O:BAG:SYD:(A;;0xf0007;;;SY)(A;;0x7;;;BA)(A;;0x3;;;BO)(A;;0x5;;;SO)(A;;0x1;;;IU)(A;;0x3;;;SU)(A;;0x1;;;S-1-5-3)(A;;0x2;;;S-1-5-33)(A;;0x1;;;S-1-5-32-573)
wevtutil sl security /ca:existing-SDDL-string(A;;0x1;;;s-1-5-20)Example:
wevtutil sl security /ca:O:BAG:SYD:(A;;0xf0007;;;SY)(A;;0x7;;;BA)(A;;0x3;;;BO)(A;;0x5;;;SO)(A;;0x1;;;IU)(A;;0x3;;;SU)(A;;0x1;;;S-1-5-3)(A;;0x2;;;S-1-5-33)(A;;0x1;;;s-1-5-20)