Windows 2000 how Win2003 event collection?
Yes, it is the same process. Just add the host name or IP in the manage Windows Service part of the GUI, overwrite the Domain if it is not there, use the hostname or IP instead of Domain if it is not on a Domain, the system will prompt you for credentials, and then - provided the communication path is clear (see ports used by enVision in online help / SCOL) and the system is generating events - you will start collecting.
CustomSD Restricts access to the event log. This value is of type REG_SZ. The format used is Security Descriptor Definition Language (SDDL). Construct an ACL that grants one or more of the following rights: Clear (0x0004) Read (0x0001) Write (0x0002) To be a syntactically valid SDDL, the CustomSD value must specify an owner and a group owner (for example, O:BAGY), but the owner and group owner are not used. If CustomSD is set to a wrong value, an event is fired in the System event log when the event log service starts, and the event log gets a default security descriptor which is identical to the original CustomSD value for the Application log. SACLs are not supported. For more information, see Event Logging Security. Windows Server 2003: SACLs are supported. Windows XP/2000: This value is not supported.