How to fix "Subscribe operation with Push delivery mode is only available on remote sessions."

Error Description

The error "Subscribe operation with Push delivery mode is only available on remote sessions." occurs in Windows when you attempt to create a local event log subscription using WS-Management (WS-Man) or Windows Remote Management (WinRM) with the Push delivery mode. By design, Windows Event Forwarding (WEF) restricts Push-based subscriptions to remote target computers. If the collector and the source computer are the same local machine, Windows rejects the Push configuration because it expects local event collection to be handled via Pull subscriptions or local event queries.

Step-by-Step Fixes

Fix 1: Switch the Subscription Type to Source-Initiated (Pull Mode)

The most effective way to resolve this error on a local machine is to change the subscription type from Collector-Initiated (Push) to Source-Initiated (Pull).

1. Open the Event Viewer by pressing Win + R, typing eventvwr.msc, and pressing Enter.
2. In the left console tree, click on Subscriptions.
3. Right-click the problematic subscription from the list and select Properties.
4. In the Subscription Properties window, change the radio button selection from Collector initiated to Source computer initiated.
5. Click the Advanced button.
6. Ensure that the protocol and user account settings match your deployment requirements, then click OK.
7. Click Apply and then OK to save the changes.

Fix 2: Reconfigure via Command Line (WEVUTIL)

If you are deploying the subscription using an XML configuration file and the wevtutil tool, you must change the DeliveryMode flag in your XML template.

1. Open your subscription configuration XML file in a text editor like Notepad.
2. Locate the <Delivery Mode="..."> XML tag.
3. Change the mode value from Push to Pull. It should look like this:

   <Delivery Mode="Pull">

4. Save and close the XML file.
5. Open Command Prompt as an Administrator (Right-click, select Run as administrator).
6. Delete the old faulty subscription by running:

   wevtutil ds "SubscriptionName"

7. Re-import the updated XML configuration file by running:

   wevtutil cs "C:\Path\To\Your\subscription.xml"

Fix 3: Target a Remote Computer Instead of Localhost

If your project requirements strictly dictate that you must use a Push-based delivery mode, you cannot target the local machine. You must modify your subscription target settings to point to a distinct remote computer.

1. Open the Event Viewer (eventvwr.msc) and go to Subscriptions.
2. Right-click your subscription and open Properties.
3. Ensure Collector initiated is selected.
4. Click on the Select Computers... button.
5. Remove localhost, 127.0.0.1, or the local computer name from the list.
6. Click Add Domain Computers..., type the name of a valid remote Windows computer on your network, and click OK.
7. Click Test to ensure the collector can connect to the remote machine's WinRM service, then click OK and save.