I would like to set every client PC to forward certain events to their authenticating DC.
I am trying to track logon events by having all workstations stations forward events to the DC they are currently authenticated to and then have every DC forward these events to a main event collector.
Is it possible to set the value in the "Configure target subscription manager" like this somehow: "Server=%logonserver%".
The only alternative would be to link a different GPO to every site and manually specify a server in each site to forward the events to.