commandToPrepEventLogForwarding.ps1

### Run on SOURCE computers
# from elevated command prompt
winrm quickconfig
# Collecting from DC(s)? Then you won't be able to modify local policy or local admin group, do this instead on each SOURCE
wevtutil sl security /ca:O:BAG:SYD:(A;;0xf0005;;;SY)(A;;0x5;;;BA)(A;;0x1;;;S-1-5-32-573)(A;;0x1;;;s-1-5-20)


### Run on COLLECTOR computer
#from elevated command prompt
wecutil qc