https://community.splunk.com/t5/Getting-Data-In/Agentless-event-gathering-on-Win2008/m-p/48462#M96743 <P>There are no issues in using WMI with Windows 2008 R2. Here is a full article on how to configure WMi support -- as well as permissions, rights, and other considerations:</P> <P><A href="http://www.splunk.com/base/Documentation/4.1.7/admin/MonitorWMIdata" rel="nofollow">http://www.splunk.com/base/Documentation/4.1.7/admin/MonitorWMIdata</A></P> <P>One thing to keep in mind when using W2K8 R2 is that Windows Firewall is enabled by default. In order to allow WMI, you need to add a rule:</P> <PRE><CODE>netsh firewall set service RemoteAdmin enable </CODE></PRE> Wed, 23 Feb 2011 07:39:49 GMT Ron_Naken 2011-02-23T07:39:49Z https://community.splunk.com/t5/Getting-Data-In/Agentless-event-gathering-on-Win2008/m-p/48461#M96742 <P>I've worked with the WMI agentless event gathering for Splunk in older versions of Windows, but it looks like Win2008 R2 has moved to the new facility of WinRM. Can Splunk collect Win2008 R2 events via WinRM?</P> Wed, 23 Feb 2011 00:58:45 GMT https://community.splunk.com/t5/Getting-Data-In/Agentless-event-gathering-on-Win2008/m-p/48461#M96742 cattle 2011-02-23T00:58:45Z https://community.splunk.com/t5/Getting-Data-In/Agentless-event-gathering-on-Win2008/m-p/48462#M96743 <P>There are no issues in using WMI with Windows 2008 R2. Here is a full article on how to configure WMi support -- as well as permissions, rights, and other considerations:</P> <P><A href="http://www.splunk.com/base/Documentation/4.1.7/admin/MonitorWMIdata" rel="nofollow">http://www.splunk.com/base/Documentation/4.1.7/admin/MonitorWMIdata</A></P> <P>One thing to keep in mind when using W2K8 R2 is that Windows Firewall is enabled by default. In order to allow WMI, you need to add a rule:</P> <PRE><CODE>netsh firewall set service RemoteAdmin enable </CODE></PRE> Wed, 23 Feb 2011 07:39:49 GMT https://community.splunk.com/t5/Getting-Data-In/Agentless-event-gathering-on-Win2008/m-p/48462#M96743 Ron_Naken 2011-02-23T07:39:49Z