I have cluster setup and we need to collect local logging logs from work station using WMI without install UF on targets so I need to know the pre-request .
It can be done:
But it is sub-optimal to using a standard UF and has downsides and complications:
I would also consider using Windows Event Forwarding (WEF). WMI log collection has always been problematic for me at scale, since WMI breaks a lot. We use WEF with all our VDIs (45k+).