The Agents read the logs that are on the machine they are installed on, so you'll only get events from the Domain Controllers. Where the Domain Controllers are contacted by the workstations (ie, for machine or user authentication events) you should get those events in the DC logs, assuming you have an audit policy that generates events for that. For events that only occur on the local machines, like disk full events on a workstation or an anti-virus process stopping, you have to have the Agent on the workstation for those events.
↧