Why are end user PC event logs are filling up after installing the AD Agent?

This article applies to:

• R3000
• AD Agent

Question:

• Why are end user PC event logs are filling up after installing the AD Agent?

Reply:

The probes are the only mechanism of the AD Agent that would try to directly contact an end user PC.  The probes are an optional setting. The WMI probe tries to contact systems that are active in the sessions tab to make sure those systems are still logged in, like heartbeats.  If there's a permission issue or something along those lines that makes the end user/PC reject the probe, it'll simply generate a lot of those errors and the event logs will fill up.