Examkin

Question

Difficulty: MediumWindows Administrative and System Management Tools

A systems administrator is configuring a centralized log management solution within an Active Directory domain. The administrator needs to set up a subscription on a Windows console to automatically collect and aggregate system and security event entries forwarded from multiple remote client workstations across the network. Which Windows administrative tool should the administrator use to manage these event subscriptions?

  1. Event ViewerAnswer
  2. B
    Performance Monitor
  3. C
    Component Services
  4. D
    Task Scheduler

Answer

Event Viewer is the correct tool because its Subscriptions node manages Windows Event Forwarding (WEF) to centralize event logs from remote network computers.
Event Viewer (eventvwr.msc) features a Subscriptions node used by administrators to configure Windows Event Forwarding (WEF). This allows a designated collector computer to aggregate events from remote source devices.

Step-by-Step Solution

1
Identify the core requirement
The scenario requires centralizing system and security event logs forwarded from remote Windows workstations.
Windows Event Forwarding (WEF) allows collector machines to aggregate log data from source computers.
2
Evaluate available administrative tools
Event Viewer (eventvwr.msc) includes a dedicated Subscriptions folder built specifically to define and manage event collector rules.
Neither Performance Monitor, Component Services, nor Task Scheduler natively manage event log subscription feeds.

Key Concept

Centralized Event Log Management via Event Viewer Subscriptions
Rate this question

Topics

Windows Administrative and System Management Tools

More questions from this topic