Viewing the Event Logs of a GUI-Less Server Core Installation from a Remote Windows Server

Q: What do I need to do to allow my administrators to view the event logs of a GUI-less Windows Server 2012 Server Core installation remotely from a regular GUI-based Windows installation?

A: Instead of using the wevtutil.exe utility from the command line to view the logs locally on a Server Core installation, you can allow remote administrators to look at the logs using the Microsoft Management Console (MMC) Event Viewer snap-in from a remote GUI-based Windows installation. By default, this is blocked by Windows Firewall. To allow remote administration, you must execute the following command at the Server Core command prompt:

Netsh advfirewall firewall set rule group =  "Remote Administration" new enable = yes

(Although this command wraps here, you'd put it on all one line in the command shell window.) This Netsh command will create a Windows Firewall rule group on the Server Core server to allow for remote administration. After you successfully execute this command, your administrators can log on to a regular Windows server, launch Event Viewer, and select the Connect to Computer option to remotely connect to the Server Core server.