Fix: The WinRM client cannot process the request because the subscription contains no domain or non-domain sources

Error Description

This Windows error occurs within the Windows Event Collector (WEC) service when a Source-Initiated Subscription (Windows Event Forwarding) is created, but its security permissions are completely blank.

The service drops the connection because the subscription XML configuration lacks explicit definitions for which computers are allowed to forward logs. To protect the system, WinRM blocks the request until you tell it exactly which Active Directory domains or non-domain (workgroup) computers have the rights to connect.

Step-by-Step Easy Fix

You can fix this error by defining the allowed computer sources using Event Viewer or PowerShell on your Event Collector server.

Method 1: Using the Event Viewer GUI (Easiest)

1. Open the Start Menu, type Event Viewer, right-click it, and select Run as administrator.
2. In the left panel, click on Subscriptions.
3. Locate your broken subscription in the center pane, right-click it, and choose Properties.
4. Look at the bottom of the properties window and click the Advanced button.
5. In the Advanced Subscription Settings window, locate the Allowed Source Computer Groups section.
6. Click the Domain Computers button (if your machines are in an Active Directory Domain) or Non-Domain Computers (if you use workgroups and certificates).
7. Add the specific computer objects, security groups (such as Domain Computers), or issuer certificate parameters required for your network.
8. Click OK to close the Advanced settings, and then click OK again to save the subscription.
9. Open an elevated Command Prompt and restart the Windows Event Collector service by typing:

   net stop wecsvc && net start wecsvc

Method 2: Using the Command Line (Fastest)

If you prefer using the command line or need to fix this over an administrative terminal session, you can update the subscription directly with the wecutil tool.

1. Open the Start Menu, search for Command Prompt, right-click it, and select Run as administrator.
2. Run the following command to inject the default Active Directory Domain Computers permission group directly into your subscription (replace YourSubscriptionName with the actual name of your subscription):

   wecutil ss "YourSubscriptionName" /asd:"O:NSG:NSD:(A;;GA;;;DC)(A;;GA;;;NS)"

3. If your sources are Non-Domain machines, use this command to bind your specific allowed certificate issuer configuration instead:

   wecutil ss "YourSubscriptionName" /asnd:"IssuerValue"

4. Force the Event Collector service to update its cache by running:

   wecutil rsc "YourSubscriptionName"