No, the agent needs to be installed on all domain controllers to really have anything close to decent coverage. In most cases you also want to install it on all servers to capture their local events, and depending on your policy may also need to be installed on all workstations.
↧