/esa:EVENT_SOURCE (EventSourceAddress) Specifies the address of an event source. EVENT_SOURCE is a string that identifies ...

/esa:EVENT_SOURCE   (EventSourceAddress)
Specifies the address of an event source. EVENT_SOURCE is a string that identifies a
machine serving as a source of events using fully-qualified domain name, NetBIOS name,
or an IP address. This option should be used with /ese (EventSourceEnabled),
/aes (AddEventSource), /res (RemoveEventSource), or /un (UserName) and /up (UserPassword)
options.

/ese[:VALUE]  (EventSourceEnabled)
Enable or disable an event source. VALUE can be true or false. This option is allowed
only if /esa (EventSourceAddress) option is specified. The default value of this option
is true.

OPTIONS SPECIFIC TO COLLECTOR INITIATED SUBSCRIPTIONS:

/aes  (AddEventSource)
Adds event source specified by the /esa (EventSourceAddress) option, if it is not already
a part of the subscription. If the address specified by the /esa (EventSourceAddress) is
already a part of the subscription, an error is raised. This option is allowed only if
/esa (EventSourceAddress) option is specified.

/res  (RemoveEventSource)
Removes event source specified by the /esa (EventSourceAddress) option, if it is already
a part of the subscription. If the address specified by the /esa (EventSourceAddress)
is not a part of the subscription, an error is raised. This option is allowed only if
/esa (EventSourceAddress) option is specified.

/un:USERNAME   (UserName)
Specifies user credential to be used with the source specified by the
/esa (EventSourceAddress) option. This option is allowed only if /esa (EventSourceAddress)
option is specified.

/up:PASSWORD   (UserPassword)
Sets the user password for the user credential for the source specified by the
/esa (EventSourceAddress) option. This option is allowed only if /un (UserName) option
is specified.

/tp:TRANSPORTPORT   (TransportPort)
Port number used by transport when connecting to remote event source. If not specified the 
port defaults to the standard one used for the given transport name: 80 for http, 443 for 
https

/hn:NAME   (HostName)
String that specifies the FQDNS name of the local machine. This name is used by remote
event source to push back events and must be used for push subscription only. It is used
in scenarios involving multi-homed servers that may have multiple FQDNS names.

/ct:TYPE   (CredentialsType)
String that specifies the credential type to be used for remote source access. TYPE may
be one of the following values: "default", "negotiate", "digest", "basic" or
"localmachine". The default value is "default".

/cun:USERNAME   (CommonUserName)
Sets shared user credential to be used for event sources that do not have their own user
credentials.
Note: if this option is specified with the /c (Config) option, UserName/UserPassword
settings for individual event sources from the configuration file are ignored. If you
want to use different credential for a specific event source, you may override this
value by specifying the /un (UserName) and /up (UserPassword) for a specific event
source on the command line of another ss (set-subscription) command.

/cup:PASSWORD   (CommonUserPassword)
Sets the user password for the shared user credential. When PASSWORD is set to
* (asterisk), the password is read from the console. This option is only valid when
/cun (CommonUserName) option is specified.





OPTIONS SPECIFIC TO SOURCE INITIATED SUBSCRIPTIONS:

/ica:THUMBPRINTS   (AllowedIssuerCA)
Sets the list of issuer certificate thumbprints, in a comma separated list.

/as:SUBJECTS   (AllowedSubjects)
Comma separated list of strings that specifies the DNS names of non-domain computers
allowed to initiate subscriptions. The names may be specified using wildcards, like
"*.mydomain.com". By default this list is empty.

/ds:SUBJECTS   (DeniedSubjects)
Comma separated list of strings that specifies the DNS names of non-domain computers
not allowed to initiate subscriptions. The names may be specified using wildcards, like
"*.mydomain.com". By default this list is empty.

/adc:SDDL   (AllowedSourceDomainComputers)
A string which specifies which domain computers are allowed or not to initiate
subscriptions, in SDDL format. Default is to allow all domain computers.





EXAMPLES:

Update subscription configuration named sub1 from a new XML file, WsSelRg2.xml.
wecutil ss sub1 /c:%Windir%\system32\WsSelRg2.xml

Update subscription configuration named sub2 with multiple parameters:
wecutil ss sub2 /esa:myComputer /ese /un:uname /up:* /cm:Normal

Update the allowed and denied subject lists for a source initiated subscription:
wecutil ss sub3 /as:"*.private.mydomain.com" /ds:"*.public.mydomain.net,*.mydomain.tv"