Home → Supercharger KB → How To → All subscriptions have 0 active forwarders; System Event IDs 10128, 10129
5.6. All subscriptions have 0 active forwarders; System Event IDs 10128, 10129
None of the subscriptions on a collector have any active forwarders (sources). Everything appears to be correct. Events were forwarding before. System event log shows error events 10128 and 10129. This also helps when the eventforwarding log has error 105 with code 2150859027.
Samples
- The WinRM service is not listening for HTTP requests because there was a failure binding to the URL (http://+:5985/wsman/SubscriptionManager/WEC) in HTTP.SYS.
- The WS-Management client is not listening for pushed events because there was a failure binding to the URL (http://+:5985/wsman/subscriptions/C66628DA-E0B8-43BF-A210-C4B685C23608) in HTTP.SYS.
Run netsh http show urlacl and find the URL mentioned in 10128. Take note of the SDDL for that URL.
Go to another collector that is working correctly. Run the same command. Compare the SDDL to that from the problem collector.
In our case the problem collector (Win2016) was
Reserved URL: http://+:5985/wsman/
User: NT SERVICE\WinRM
Listen: Yes
Delegate: No
SDDL: D:(A;;GX;;;S-1-5-80-569256582-2953403351-2909559716-1301513147-412116970)
But on a functioning collector (happened to be Win2012r2) it was
Reserved URL: http://+:5985/wsman/
User: NT SERVICE\WinRM
Listen: Yes
Delegate: No
User: NT SERVICE\Wecsvc
Listen: Yes
Delegate: No
SDDL: D:(A;;GX;;;S-1-5-80-569256582-2953403351-2909559716-1301513147-412116970)(A;;GX;;;S-1-5-80-4059739203-877974739-1245631912-527174227-2996563517)
Also, the default for Win2016 and 2019 is:
Reserved URL: http://+:5985/wsman/
User: NT SERVICE\WinRM
Listen: Yes
Delegate: No
SDDL: D:(A;;GX;;;S-1-5-80-569256582-2953403351-2909559716-1301513147-412116970)
We ran from administrator command prompt (cmd, not PowerShell) the following
netsh http delete urlacl url=http://+:5985/wsman/
netsh http add urlacl url=http://+:5985/wsman/ sddl=D:(A;;GX;;;S-1-5-80-569256582-2953403351-2909559716-1301513147-412116970)(A;;GX;;;S-1-5-80-4059739203-877974739-1245631912-527174227-2996563517)
and that fixed it immediately. Maybe we restarted the winrm and wec.