write-ups and what not

Setting up a Windows Event Collector



MSEDGEWIN10 Windows 10 Enterprise Evaluation Source Machine
WIN-BO2CT95INDP Windows Server 2016 Collector Machine
  • The FQDN for WIN-BO2CT95INDP is win-bo2ct95indp.bossmanben.local


1. The Source Machine (MSEDGEWIN10) is part of a Domain Controller (WIN-BO2CT95INDP).

2. This guide uses Security Logs as an example.

3. The steps below will create a subscription that collects Security logs from the Source Machine (MSEDGEWIN10).


i. Start the WinRM service

  1. Open PowerShell on the Source Machine (MSEDGEWIN10):
    winrm quickconfig
    • Add the Collector Machine to the Source Machine’s trustedhosts:
      Set-Item wsman:localhost/client/trustedhosts
    • Restart the service for changes to take effect:
      Restart-Service WinRM
  2. Check if the service is running:
    winrm get winrm/config
            AllowRemoteAccess = true
            AllowRemoteShellAccess = true
    • AllowRemoteAccess = true signifies that the service is running.

  3. Test if the Collector Machine (BOSSMANBEN) is reachable using WinRM:
    Test-WSMan WIN-BO2CT95INDP
    wsmid           :
    ProtocolVersion :
    ProductVendor   : Microsoft Corporation
    ProductVersion  : OS: 0.0.0 SP: 0.0 Stack: 3.0
    • WinRM is enabled by default on Windows Server 2012 and up.
    • This is just a measure to check if the Collector Machine is indeed reachable.

ii. Add the Collector Machine to the Event Log Readers groups

In the Source Machine (MSEDGEWIN10):

  1. Open the Local Users and Groups:

    • Press Win + R then enter lusrmgr.msc

  2. Navigate to Local Users and Groups (Local) > Groups:

    1. Right-click Event Log Readers and select Properties
    2. Select Add...

  3. Select Object Types... then check the box, Computers

  4. Enter the object names to select – “WIN-BO2CT95INDP

    • Select Check Names for good measure.
  5. Select OK when done.

iii. Create Subscriptions using Event Viewer

In the Collector Machine (WIN-BO2CT95INDP):

  1. Open the Event Viewer:

    • Press Win + R then enter gpedit eventvwr.msc
  2. On the left panel, right-click on Subscriptions then select Create Subscription...

    1. Subscription Name – Remote Security Logs
    2. Description – Security Logs from the Domain Computer, MSEDGEWIN10
    3. Destination log – Forwarded Events

      • Custom logs could be created but Forwarded Events is selected by default.
      • Click here to create custom logs.
    4. Select Subscription type and source computers:

      If you choose Collector initiated, then select Select Computers...

      1. Select Add Domain Computers...
      2. Enter the object name to select – “MSEDGEWIN10
      3. Select Check Names for good measure.
      4. Select OK
      5. Select Test for good measure.
      6. Select OK

      For Source initiated, select Select Computer Groups... then do the following extra steps on the Source Machine

      1. Press Win + R then enter gpedit.msc

        1. Navigate to Computer Management > Administrative Templates > Windows Components > Event Forwarding
        2. Right-click on Configure target Subscription Manager then select Edit
        3. Choose Enabled
        4. Under Options, beside SubscriptionManagers, press Show...
        5. Enter Server= http://win-bo2ct95indp.bossmanben.local:5985 /wsman/SubscriptionManager/WEC, Refresh=30
        6. Press OK
        7. Press OK
      2. Open PowerShell or cmd the run gpupdate /force

      For Source initiated, do the following on the Collector Machine (WIN-BO2CT95INDP)

      1. Open PowerShell or cmd then run wecutil quick-config
    5. Select Select Events...:

      1. Logged – “Any time
      2. Event levelCritical, Error, Information, Warning
      3. Choose By logWindows -> Security
      4. Filter Event IDs – 4624, 4657, 4688, 4698, 4720, 4722, 4724, 4732, 4738, 4769
      5. Select OK
    6. Select Advanced...:

      1. User Account – Choose Machine Account
      2. Event Delivery Optimization – Choose Minimize Latency
      3. Select OK
      Normal Does not conserve bandwidth 15 minutes via pull delivery
      Minimize Bandwidth Bandwidth for delivery is controlled 6 hours via push delivery
      Minimize Latency Delivery with minimal delay 30 seconds via push delivery
    7. Select OK
  3. Right-click on the newly created subscription then select Runtime Status:

    [MSEDGEWIN10.bossmanben.local] - Error - Last retry time: 7/17/2019 8:27:52 PM. 
    Code (0x138C): <f:ProviderFault provider="Event Forwarding Plugin" path="C:\Windows\system32\wevtfwd.dll" 

In the Source Machine (WIN-BO2CT95INDP)

  1. Run wevtutil:
    wevtutil get-log Security
    name: Security
    enabled: true
    type: Admin
    isolation: Custom
    channelAccess: O:BAG:SYD:(A;;0xf0005;;;SY)(A;;0x5;;;BA)(A;;0x1;;;S-1-5-32-573)
      logFileName: %SystemRoot%\System32\Winevt\Logs\Security.evtx
      retention: false
      autoBackup: false
      maxSize: 20971520
      fileMax: 1
  2. Add the Network Service Account (S-1-5-20) to the channelAccess field:
    wevtutil set-log Security /ca:"O:BAG:SYD:(A;;0xf0005;;;SY)(A;;0x5;;;BA)(A;;0x1;;;S-1-5-32-573)(A;;0x1;;;S-1-5-20)"
    • WinRM runs under the Network Service Account which had no access to the Security Logs

Going back to the Collector Machine (WIN-BO2CT95INDP)

  1. Go to the Event Viewer:

    • Press Win + R then enter gpedit eventvwr.msc
  2. On the left panel, go to Subscriptions then select the recently created subscription

  3. On the right panel, under the subscription name, select Retry

  4. Right-click on the recently created subscription then select Runtime Status:

    [MSEDGEWIN10.bossmanben.local] - Active - : No additional status.
    • An Event with ID 100 (Name=”SubscribeSuccess”) will appear on Microsoft-Windows-Event-ForwardPlugin/Operational in the Source Machine (MSEDGEWIN10)

iv. Wait for logs to be sent to the Forwarded Events logs


  • TImestamps are preserved
  • Log contents are preserved