Error codes when installing LME.

[marceloalexei]

Hello, I am attempting to install LME for my workplace, I am not an expert and because of this would appreciate step-by-step solutions as simple as you can get them, sorry about this.
After going through the first chapter, I noticed a problem when I ran event viewer, stating that "Code (0x8033808F): The client could not start a valid listener to receive subscription events based on the specified input settings."
When I go to the System logs, I see that winRM has an eventID 10149; The WinRM service is not listening for WS-Management requests. 10MS before, it has eventID 10148, stating it IS listening for those requests.
I created the GPOs, imported their settings, and then on the Client, changed subscription manager to the FQDN, and yes, it is resolvable on my laptop here.
When creating OUs, I think I ran into my first issue. I created an OU for the clients, called ClientsLME or something like this. I added my laptops domain to it, and even created a new computer for testing purposes and added it there too.
For my WEC, I was told to have the domain controller and the wec run from the same computer (server). I already had an OU for Domain Controllers with the computer that I needed the events forwarded to on it. So, I linked LME-WEC-Client to my CLientsLME, and then linked LME-WEC-Server to Domain Controllers. I've tried doing the restriction of winRM and not doing it, same problem either way. Of course, after, I created my subscription and it gives me the code I gave up above every time I try to retry the service.

• I have restarted the machine.
• I have gpupdate /force on my side and the domain controller/wec.
• I have done all the netsh http things that google offers for me to do.
• I have checked winrm enumerate to make sure it is running. It is. Even after the code is given, I check, and it's running.
• I have restarted winrm through services.
• I have double checked to see I typed the FQDN in correctly, I have even deleted all the LME files I installed, the OU, the subscription, and tried again, and still same issue.
• Port 5985 is open. On both ends.
  Maybe this is a super easy fix that I am missing. I do not know. I just wanted to come on here and ask the question as I am a little bit lost on how to go forward.
  I will say on the first installation, I ignored the issue and went through, and I could see after step 2 that the sysmon-task was running on my laptop (the client). I don't know if this helps at all.

[aarz-snl]

Sorry to hear you're having issues.

It's tough to tell right out of the gate, but trying to see some of the things you maybe didn't mention:

Did you run these steps too:

Download the [lme_wec_config.xml](https://github.com/cisagov/LME/blob/main/Chapter%201%20Files/lme_wec_config.xml) file to the Windows Event Collector server. Run a command prompt as an administrator, change to the directory containing the wec_config.xml file you just downloaded. Run the command wecutil cs lme_wec_config.xml within the elevated command prompt. There is no output displayed after running this command.

[marceloalexei]

Yes sir, I have two. I am only using 1, shall I disable the second and retry?
If I do disable the second, should I gpupdate, restart, and try?

[aarz-snl]

Possibly -- I ask that only because I googled the error code and saw a couple things about NIC's -- I dont want to say it's the end all be all fix here because it wasn't necessarily from fully legit sources.

Theres also some commands here to verify the correct listener etc:

https://learn.microsoft.com/en-us/windows/win32/winrm/installation-and-configuration-for-windows-remote-management

[marceloalexei]

Yeah I disabled and tried and keep getting the same error. I am unsure why winRM stops, I looked at the config settings and everything looks right, I don't believe we need ipv6 enabled correct? It just listens on an ipv4 basis currently. All the correct IP addresses are listed when i enumerate as well, I'm not sure if I should maybe be changing some kind of group policy in LME-WEC-Client or Server?

[marceloalexei]

I fixed it, turns out I needed all other adapters disabled as well, not just NIC2. Thank you for your help.

[llwaterhouse]

Thank you for posting your solution.