See explanation below.
Explanation
Configuring the event source computer
1. Run the following command from an elevated privilege command prompt on the Windows Server domain controller to configure Windows Remote Management:
winrm qc -q
2. Start group policy by running the following command:
%SYSTEMROOT%\System32\gpedit.msc
3. Under the Computer Configuration node, expand the Administrative Templates node, then expand the Windows Components node, then select the
4. Right-click the SubscriptionManager . Enable the SubscriptionManager setting, and click the Show button to add a server address to the setting. Add at least one setting that specifies the event collector computer. The window contains an Explain tab that describes the syntax for the setting.
5. After the SubscriptionManager setting has been added, run the following command to ensure the policy is applied:
gpupdate /force
Configuring the event collector computer
1. Run the following command from an elevated privilege command prompt on the Windows Server domain controller to configure Windows Remote Management:
winrm qc -q
2. Run the following command to configure the Event Collector service:
wecutil qc /q
3. Create a source initiated subscription. This can either be done programmatically, by using the Event Viewer, or by using Wecutil.exe. If you use Wecutil.exe, you must create an event subscription XML file and use the following command:
wecutil cs configurationFile.xml
Reference:
https://docs.microsoft.com/en-us/windows/win32/wec/setting-up-a-source-initiated-subscription#forwarding-the-