Command: wecutil qc /q. Server: Server1 only.

wecutil qc, the quick-config option of the Windows Event Collector utility, is the command that enables and starts the Windows Event Collector service on a machine, and it must be run on whichever computer is going to act as the event collector for the subscription. In this scenario, Server1 is the intended destination that will receive the forwarded events from DC1, meaning Server1 is the collector and DC1 is only the event source, so the command must be run on Server1, not on DC1. wevtutil is a related but different utility that manages individual event logs and their configuration, such as querying, exporting, or clearing logs, rather than enabling the collector service itself, so it does not accomplish this task. winrm qc only configures and quick-starts the Windows Remote Management service, which is a separate prerequisite that may need to be enabled on both the source and the collector for subscriptions to function, but running it alone does not enable event collection. Running wecutil qc /q on Server1 alone is therefore the correct command and target to enable the event subscription infrastructure needed to forward events from DC1.