The syntax described above is not correct, the "/r:" switch is used for remote operations, not for set the retention.$0
The right usage is:$0
wevtutil sl Application /rt:true /ab:true
↧