How to Centralize Windows Events with Windows Event Forwarding
A production WEF workflow covering collector-initiated and source-initiated subscriptions, WinRM, event sizing, SDDL, filtering, buffering, and proof.
Windows Event Forwarding (WEF) uses Windows Event Collector and WS-Management to deliver selected events from endpoints to a collector. It can centralize security and operational evidence without installing a separate endpoint agent, but a subscription is only reliable when authentication, source permissions, filter volume, buffering, collector capacity, and end-to-end tests are designed together.
Choose the subscription ownership model
In a collector-initiated subscription, the collector is configured with explicit source computers and connects to them. In a source-initiated subscription, endpoints learn one or more subscription-manager URLs—commonly through Group Policy—and enroll with the collector. Source-initiated design fits large domain fleets because endpoint membership can be controlled by groups and policy rather than editing a collector list.
Decide whether the collector receives RenderedText or Events content format. Rendered text eases downstream reading and avoids missing provider message resources on the collector, but increases event size. Events format is compact and may require provider metadata to render correctly later. Select intentionally and benchmark.
Prepare collector and endpoints
On the collector, initialize the Windows Event Collector service with the supported administrative command or management tooling, configure service startup, and create a subscription through Event Viewer or wecutil. Use Kerberos in a healthy domain where possible; HTTPS/certificate configuration is required for untrusted/workgroup scenarios and needs its own lifecycle.
For source-initiated forwarding, Group Policy configures the subscription manager, for example using the documented Server=http://collector:5985/wsman/SubscriptionManager/WEC,... form generated for the environment. Do not copy a sample thumbprint or URL. Allow the Network Service account to read channels that require it by adjusting channel access through supported policy/SDDL with the narrowest necessary rights.
Avoid adding endpoints to broad local groups merely to make one protected log readable. Changes to Security log access and audit policy have security consequences; document and test them.
Filter at the source and size the pipeline
An XPath query can select providers, event IDs, levels, and time conditions. Filter noisy channels before transport, but retain fields investigators need and account for event-ID/version changes across OS builds. Start from Microsoft’s recommended intrusion-detection subscription patterns, then align with actual detection and retention requirements.
Subscription delivery modes trade latency for batching. Normal mode balances traffic, Minimize Bandwidth delays/batches more, and Minimize Latency increases delivery frequency. Endpoints buffer forwarded events in their local event logs/forwarding system only within configured capacity. Network outages longer than retention can create gaps.
Capacity-plan collector CPU, memory, WinRM connections, ForwardedEvents log maximum size/retention, disk throughput, backup, and downstream SIEM ingestion. A collector whose ForwardedEvents channel overwrites faster than ingestion silently loses centralized evidence even while endpoints report success.
Prove delivery and detect gaps
Generate a harmless known event on a test source, record its source computer, channel, event ID, record ID, and timestamp, and trace it into ForwardedEvents and the downstream store. Use wecutil gr/gs and Event Viewer runtime status to inspect active sources and errors. Check WinRM configuration and relevant operational channels rather than disabling firewalls.
Test endpoint reboot, collector reboot, DNS/Kerberos failure, network isolation, certificate expiry where applicable, a full collector disk, new machine enrollment, decommission, and policy rollback. Alert on collector service health, active-source drop, subscription errors, queue age, and ingestion lag.
WEF is complete only when a selected source event arrives with intact identity inside a measured time and an outage produces a visible alert. A green subscription configuration without a synthetic end-to-end event is not monitoring evidence.
Related:
- How to Enable PowerShell Script Block, Module, and Transcription Logging
- The Windows Object Manager Namespace: Handles, Named Objects, and Object Directories
Sources: