From: Allan Miller on
When I try to create a subscription that is "Computer Source Initiated", it
will give me a message stating "XYZ cannot be translated to a security
identifier"

It does this if XYZ is a computer or group.

I don't know if it makes a difference but here is the domain lay out and the
only thing I can find wrong.
Say that there is a parent domain named 123.domain.com with a Netbios name
of NT123 and a child domain named ABC.123.domain.com with a Netbios name of
NTABC. I am trying to add Domain Controllers as the source computers (All
2003 computers with WinRM installed and configured). After I select the
Domain Controllers group from the ABC domain it shows it in the list as
"ABC\Domain Controllers". When I hit OK to accept the list it gives me the
message I am talking about and does not add the group to the working list.

I can use "Collector Initiated" but it will not forward the Security Event
Log with the following error message on the source computers:
--
Event Type: Warning
Event Source: EventForwarder-Operational
Event Category: None
Event ID: 101
Date: 1/21/2009
Time: 6:40:16 PM
User: N/A
Computer: COMPUTERNAME
Description:
The subscription Test is created, but one or more channels in the query
could not be read at this time.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
---

Any ideas?