No Firewalls turned off on either end - Did put in my comments firewall turned off for server and client PC's
Fixed this today anyway - Event Log Forwarder - Where is the Audit Failure Type?
So found in event logs this come up - Unable to setup Windows Event Log subscribers. Subscribe failed with error 15001, The specified query is invalid.
When I googled I found the THWACK forum post and setting audit failures to a hex code didnt work...
So I uninstalled Log Viewer 1.2 and tried to install 1.19 which is what one user said to do....but this needed .net 2.0 and we are mainly windows 10 and server 2012 and above so It really didnt seem worth it to download this on all the hosts to make this work...
So I re-installed Log Viewer 1.2 - rebooted the PC and tested the KIWI Log Generator...and it showed the test message in the KIWI console on the server!
I then ran the same tests within the Log Forwader and these also generated messages to the server...
I then went and re-installed Log Forwader on the other machines I tested and these all worked as well...
This makes no sense to me whatsoever considering I hadnt changed any settings, GPOs, or port stuff, but it works so Im just chalking it down to one of those annoying IT Mysteries! So if anyone gets this just try re-installing the Log Forwader!
Thanks for replying anyway