Chapter exercise – using Event Viewer to monitor and manage logs

This exercise will teach you how to set up centralized monitoring, filter Event Viewer logs, and change the default log location. Let’s dive right in!

Setting up centralized monitoring

To set up centralized monitoring in Windows Server 2022, follow these steps:

1. Open the command prompt with elevated admin rights on a Remote Server, enter winrm quickconfig, and press Enter to configure LocalAccountTokenFilterPolicy to grant administrative rights remotely to local users.
2. Right-click on the Start button and select Computer Management.
3. Expand Local Users and Groups and click Groups.
4. Open the administrator’s group and add the central server.
5. Open a command prompt with elevated admin rights on a Central Server, enter wecutil qc, and press Enter.
6. Press Y (for yes) when prompted to do so.
7. From the command prompt window, enter eventvwr.exe to open Event Viewer.
8. Right...