"0x57" error when you use the wecutil ss /c: command to update an Event Forwarding subscription

You use the wecutil tool to manage Windows Event Forwarding subscriptions on one or more Windows Server-based computers. You try to update the subscriptions by using a configuration file. To do this, you run a command such as the following:

wecutil.exe ss /c:<configfile>.xml

However, you receive error messages such as the following:

Error: Too many arguments are specified. Error = 0x57
The parameter is incorrect.

Error: Failed to set SubscriptionType property. Error = 0x57.
The parameter is incorrect.

This issue occurs if the configuration file that you use together with the wecutiltool contains a SubscriptionType element.

If you are updating source-initiated or "push" subscriptions, you can resolve this issue by editing the configuration file. By changing the SubscriptionType element to a comment,  you remove the parameter conflict. To do this, follow these steps:

1. Open the configuration XML file.
2. Look for the following text:

   <SubscriptionType>SourceInitiated</SubscriptionType>

3. Change the text to a comment. For example:

   <!--<SubscriptionType>SourceInitiated</SubscriptionType>-->

4. Save the configuration XML file.

After you edit the configuration file, run wecutil again. For example:

wecutil.exe ss /c:<configfile>.xml

You cannot update a collector-initiated or "pull" subscription by using the wecutil tool. Instead, delete the existing subscription and create a new subscription. To do this, use the following commands:

wecutil ds <oldsubID>
wecutil cs <configfile>.xml

[Asset 4513875]

For more information about the wecutil tool, see Wecutil.exe.