This article provides brief information and steps to resolve the issue when after installing a new license of Log and Event forwarder to any Windows system, the security subscription does not complete.
1. Open the Event viewer, and then select the Security Logs.
2. Right-click to Properties, and clear the logs files.
3. Go back to Log and Event forwarder and re-attempt to subscribe to the security events.