Windows Event Forwarding (WEF) setup: collect security logs without an agent

Built-in log collection

Windows Event Forwarding sends events from many machines to a collector server using WinRM, with no extra agent. Source-initiated subscriptions, where clients connect to the collector based on Group Policy, scale to thousands of machines. The collector writes events to its Forwarded Events log, from which a SIEM agent can pick them up.

A subscription uses an XPath query to choose which events to send, so you can forward only the IDs you care about.

Set up the collector and clients

On the collector, run wecutil qc to configure the Windows Event Collector service. Create a subscription in Event Viewer or with wecutil cs and an XML file. In Group Policy for clients, set Configure target Subscription Manager to Server=http://collector.lab.local:5985/wsman/SubscriptionManager/WEC,Refresh=60, and make sure WinRM is running.

Grant the Network Service account read access to the Security log on clients by adding it to the Event Log Readers group, or the client cannot read events to send.

Snippet

# collector
wecutil qc /q
wecutil cs C:\wef\security-core.xml
wecutil gr security-core   # runtime status per source

# client GPO
# Computer Config > Admin Templates > Windows Components > Event Forwarding
#   Configure target Subscription Manager:
#   Server=http://wec01.lab.local:5985/wsman/SubscriptionManager/WEC,Refresh=60
# Add NETWORK SERVICE to Event Log Readers (Restricted Groups or GPP)

Lab: a minimal subscription

Use a subscription query that selects 4624, 4625, 4688, 4720, 4728, 4732, 1102, 7045, and PowerShell 4104. Apply the GPO to one lab workstation, run gpupdate, generate a failed logon, and confirm it appears in Forwarded Events on the collector within a minute or two.

If nothing arrives, check wecutil gr for the source’s status and the client’s Microsoft-Windows-Eventlog-ForwardingPlugin/Operational log for errors.

Snippet

<QueryList>
  <Query Id="0" Path="Security">
    <Select Path="Security">*[System[(EventID=4624 or EventID=4625 or EventID=4688 or EventID=4720 or EventID=4728 or EventID=4732 or EventID=1102)]]</Select>
  </Query>
  <Query Id="1" Path="System">
    <Select Path="System">*[System[(EventID=7045 or EventID=104)]]</Select>
  </Query>
  <Query Id="2" Path="Microsoft-Windows-PowerShell/Operational">
    <Select Path="Microsoft-Windows-PowerShell/Operational">*[System[(EventID=4104)]]</Select>
  </Query>
</QueryList>

Scaling and gaps

Raise the Forwarded Events log size on the collector, and use several collectors for large fleets. Monitor for clients that stop reporting, since a missing source is as important as a suspicious event.

WEF over HTTP on a domain still encrypts traffic with Kerberos. For non-domain machines, use HTTPS with certificates.

Diagram

Events from clients to collector

GPO
Clients learn the Subscription Manager address.
Read
NETWORK SERVICE reads the Security log via Event Log Readers.
Send
WinRM delivers events matching the XPath query.
Collect
Collector writes to Forwarded Events; a SIEM reads from there.
Command
```
wecutil gr security-core
```

Check yourself

1. Which command prepares the collector service?

2. Clients forward System events but not Security events. A likely cause?

3. Where do forwarded events land on the collector by default?