I have created a profile based on a Windows login with the Event Log Reader rights to retrieve Windows Events through an account that is part of the Event Log Readers group.
From the documentation provided by McAfee, RPC is required if we are connecting via Event Log Readers (I couldn't get it to work without turning on RPC).
However, we cannot create client data sources if WMI is turned on. As client data sources inherit the parent data source, I can't edit the RPC option in the client data sources either.
My only alternative seems to be using child data sources to group data sources together instead, which will limit me to the 500 data sources per receiver.
Also, if I am to create a parent data source placeholder for my child data sources, how can I disable the parent data source so it does not try to reach out to the dummy IP address?