Event log subscription returns error code (0x138C)

Solution 1:

The solution is to add the “channel access permissions” for the security log.

• Ensure the computer account of the collector is in the “Event Log Readers” builtin local security group. • Configure Event Collection on the computer to be monitored - Add the SID (S-1-5-20) of the Network Service account to the Channel Access permissions of the Security Event Log. - From an elevated command prompt:

wevtutil sl security /ca:O:BAG:SYD:(A;;0xf0005;;;SY)(A;;0x5;;;BA)(A;;0x1;;;S-1-5-32-573)(A;;0x1;;;s-1-5-20)

After approximately 20 minutes you should start to see events in the Forwarded Events

Reference: https://rockyprogress.wordpress.com/2011/12/04/security-event-log-collection-from-a-domain-controller/