I'm trying to setup event forwarding from 2003 to 2008r2. I ran the quickconfig and qc commands. I added the requester machine account to the local admin group of the source machine. I added the subscription and tested it fine, but the source computer's event log says, "The subscription drexn001 events is created, but one or more channels in the query could not be read at this time." and the subscription runtime status says, "Code (0x6): <f:ProviderFault provider="Event Forwarding Plugin" path="%systemroot%\system32\wevtfwd.dll" xmlns:f="http://schemas.microsoft.com/wbem/wsman/1/wsmanfault"><t:ProviderError xmlns:t="http://schemas.microsoft.com/wbem/wsman/1/windows/EventLog">Windows Event Forward Plugin failed to read events.</t:ProviderError></f:ProviderFault>" Any ideas? Thanks.

Hi, Are your computers in a workgroup or a domain? Have you read this article? http://technet.microsoft.com/en-us/library/cc748890.aspx Tim Quan

The computers are in a domain and I have seen that article. Both commands were run before I setup the subscription.

Any other thoughts?

Hello, This would be considered an “advanced” scenario. Unfortunately this is not something that we can really support via the forums, so the best thing to do at this point would be to open a support case with us. That will get you a dedicated engineer assigned to the case who can collect the data needed and interface with our debug teams. If you have a support contract with us, contact your TAM to get the case set up. If you don't, then this link details the various options that are available: http://support.microsoft.com/default.aspx?id=fh;en-us;offerprophone Thanks, Ankit Oberoiankit

Well, you have choosen some wrong eventprotocols in your subscription. The limitation is as follows: Windows Server 2003 (Applicationlog and Systemlog is supported) Windows Server 2003 R2 (Applicationlog, Systemlog and Installationlog is supported) Windows Server 2008 R2 (All Logs supported) If you use an unsupported log type you get the error code (0x6) Try to use an own subscription for each OS. I hope this will solve the problem...

win 2003 by default doesnt forwardsecurity events. u need to do 1 registry edit on 2k3 machines. here is link http://blogs.technet.com/b/askds/archive/2011/08/29/the-security-log-haystack-event-forwarding-and-you.aspx