Agentless event gathering on Win2008

[cattle]

I've worked with the WMI agentless event gathering for Splunk in older versions of Windows, but it looks like Win2008 R2 has moved to the new facility of WinRM. Can Splunk collect Win2008 R2 events via WinRM?

[Ron_Naken]

There are no issues in using WMI with Windows 2008 R2. Here is a full article on how to configure WMi support -- as well as permissions, rights, and other considerations:

http://www.splunk.com/base/Documentation/4.1.7/admin/MonitorWMIdata

One thing to keep in mind when using W2K8 R2 is that Windows Firewall is enabled by default. In order to allow WMI, you need to add a rule:

netsh firewall set service RemoteAdmin enable