Windows Event Loggingand Forwarding - ACSC | Cyber.gov.au

The following Group Policy settings should be defined in a separate GPO, with the scope set for all Windows hosts on the domain. In the case of multiple collection servers, GPOs need to be defined to direct the Windows hosts to their respective log collection server (Subscription Manager). ................
................