Let me start out by saying that I know absolutely nothing about SCOM.

Now that we have that out of the way.... I want to collect errors and warnings from the event logs on my desktops. Seems like ACS would be a good way to do that. I found two blog posts on this http://blogs.technet.com/b/fesiro/archive/2013/01/08/how-to-deploy-audit-collection-services-acs-in-scom-2012.aspx and http://technet.microsoft.com/library/hh272397.aspx.

What I don't understand is...

1. Do I need to deploy JUST the ACS component from the SCOM iso or is there more to it that that?

2. Do I need to deploy the SCOM agent to my desktops?

Hi,

Yes the SCOM Agent has to be installed on your Desktops. You also should keep in mind that SCOM only can collect the Security Event Log Out of the Box.

You can also refer to this article regarding ACS:

scom-2012-sp1-part-1-audit-collection-services-acs-setup

Yea, I read an article on how to make ACS collect the other event logs. That seems easy

For 1000 workstations should I require more than 1 SCOM server? SQL will be remote.

Yea, I read an article on how to make ACS collect the other event logs. That seems easy

For 1000 workstations should I require more than 1 SCOM server? SQL will be remote.