To configure an event subscription, the collector computer (the machine receiving the events) must have the Windows Event Collector service configured and running. In this scenario, Server1 is the collector because events are being forwarded to it.

The command wecutil qc (Windows Event Collector Utility Quick Config) is used specifically to configure the Windows Event Collector service. It performs the following actions:

1. Sets the Windows Event Collector service to start automatically (delayed start).
2. Starts the service.
3. Configures the Windows Firewall to allow the service to be accessed (if applicable).

The /q switch executes the command in "quiet" mode, suppressing confirmation prompts. The source computer (DC1) would require winrm qc, but the question specifically asks for the command to enable the Event Collector service, which resides solely on the collector.

Microsoft Learn. (2023). Use Windows Event Forwarding to help with intrusion detection. Retrieved from https://learn.microsoft.com/en-us/defender-for-identity/configure-windows-event-collection

Relevance: Section "Configure the collector" explicitly states: "Run the following command on the collector computer: wecutil qc".

Microsoft Learn. (2023). wecutil. Retrieved from https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/wecutil

Relevance: Defines qc as the parameter to "Configures the Windows Event Collector service" and /q as "Quiet mode".

Microsoft Learn. (2021). Configure Advanced Audit Policy. Retrieved from https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/configure-advanced-audit-policy-planning

Relevance: Confirms the architectural distinction that the collector manages the subscription state via the Event Collector service.