Greetings, I have a serious problem which i cannot solve. The environment i manage is mixed environemt: XP, Vista, server 2003 R2 and 2008. The event collector is on a w28 machine. The sources subscribe to the collector by GPO. It worked fine untill 6 months ago. I manage this environment the last month. The previous system engineer who managed this environment is gone allready. 6 of the 172 computers have a Active subscription. The otherd are inactive. When i look into the eventvwr of these sources i see every hour event ID 105 source EventForwarder-Operational: "The forwarder is having a problem communicating with subscription manager at address fqdn of my collector Error code is 8 and Error Message is <f:WSManFault xmlns:f="http://schemas.microsoft.com/wbem/wsman/1/wsmanfault" Code="8" Machine="fqdn of my source computer" xml:lang="en-US"><f:Message> The Function: &quot;WinHttpSendRequest&quot; failed unexpectedly. GetLastError=8. <f:Message><f:WSManFault>. I did a rsop at the source to be sure the GPO is applied. I did winrm id /r:<Source Computer> /a:none Result is IdentifyResponse Protocolversion = http://schemas.dmtf.org/wbem/wsman/1/wsman.xsd I did wecutil gr <subscription name> Result is the list of sources and most of them with a last heartbeat of 6 months ago. Notable is the difference is the http schema address. I have no understanding how this works. Hopefully someone can help me. Thnks in advance! Bastiaan

Hehe nice question aye? It looks like it should work but it don't for many systems...

I solved it. It was simple the Windows Remote Management (WS-Management) service which was not started... :-)