I have set up Event log forwarding to centralize the security logs on 1 collector. There are 250 source computers to get the logs from and I have used a GPO to add the collector to the "Event Log Readers" group of each source. What I am wondering is, is there a way to use powershell or a GPO, etc to add the 250 servers to the Event Viewer subscription? Using the GUI, you can only search and add 1 computer at a time. I have also tried to create an AD group, and add the computers to that, however in Event Viewer subscription (server 2012), the only object type is Computer.
I determined that source initiated using an AD group is the best way for scalability to add many computers. And that using collector initiated only has the option to add one at a time.