关注此帖子：https://blogs.technet.microsoft.com/russellt/2016/05/18/creating-custom-windows-event-forwarding-logs/之后，尽管我已经尝试将“网络服务”添加到指定的频道，并且当前订阅是“源启动”和“网络服务”位于事件日志读取器组中。关于如何解决它的任何想法？谢谢！

"The subscription WEC-*** is created,but one or more channels in the query could not be read at this time."

频道ACL：

C:\Windows\system32>wevtutil gl WEC-***

name: WEC-***

enabled: true

type: Operational

owningPublisher: WEC

isolation: Application

channelaccess: O:BAG:SYD:(A;;0x2;;;S-1-15-2-1)(A;;0xf0007;;;SY)(A;;0x7;;;BA)(A;;0x7;;;SO)(A;;0x3;;;IU)(A;;0x3;;;SU)(A;;0x3;;;S-1-5-3)(A;;0x3;;;S-1-5-33)(A;;0x1;;;S-1-5-32-573)(A;;0x1;;;S-1-5-20)

logging:

  logFileName: D:\Logs\***\WEC-***.evtx

  retention: false

  autoBackup: false

  maxSize: 10737418240

publishing:

  fileMax: 1