--- title: "Efficient Windows Event Collector Setup & Configuration" description: "Set up a Windows event collector subscription by creating an event collector, configuring GPO, and mastering WEF." canonical: "https://adamtheautomator.com/windows-event-collector/" --- # Efficient Windows Event Collector Setup & Configuration > Set up a Windows event collector subscription by creating an event collector, configuring GPO, and mastering WEF. Source: https://adamtheautomator.com/windows-event-collector/ --- ATA Learning Tap to hide [ ATA Learning ](/) * [Home](/) * [Tutorials](/tutorials/) * [Instructors](/author/) * [Advertising](/advertising/) * [Recommended Resources](/resources/) * [About Adam](/about-adam/) Search for: * [](https://twitter.com/adbertram) * [](https://github.com/Adam-the-Automator) * [](https://www.linkedin.com/company/adam-the-automator-llc) * [](/feed/) ![Efficient Windows Event Collector Setup & Configuration](https://adamtheautomator.com/wp-content/uploads/2019/10/batch-1868104_1920.jpg) # Efficient Windows Event Collector Setup & Configuration [![](https://secure.gravatar.com/avatar/87bec6692789c9e784a6c804c8730a8abc91f68609fc222eeb1068fb8d51acf8?s=192&d=mm&r=g)Jeff Christman](https://adamtheautomator.com/author/jeff/)10 October 20196 min. read Categories: [IT Ops](/category/it-ops/) Tags:[Microsoft Windows Server](/tag/microsoft-windows-server/) Table of Contents * [Windows Event Log Forwarding Overview](#windows-event-log-forwarding-overview) * [WEF Project Overview](#wef-project-overview) * [Environment and Knowledge Requirements](#environment-and-knowledge-requirements) * [Configuring the Windows Event Collector](#configuring-the-event-log-collector) * [Enabling WinRM on the Windows Event Collector](#enabling-winrm-on-the-collector) * [Starting the Subscription Collector Service](#starting-the-subscription-collector-service) * [Setting up the Forwarders’ GPO](#setting-up-the-forwarders-gpo) * [Allowing the Network Service to Read Event Logs](#allowing-the-network-service-to-read-event-logs) * [Setting up a Subscription](#setting-up-a-subscription) * [Verifying the WEF Configuration](#verifying-the-wef-configuration) * [Your Takeaways](#your-takeaways) Event log management is a critical skill to learn in all Windows environments. Activity is being recorded to Windows event logs every second and it acts as not only a security tool but also as a vital troubleshooting aid. With a feature called [Windows Event Forwarding (WEF)](https://docs.microsoft.com/en-us/windows/security/threat-protection/use-windows-event-forwarding-to-assist-in-intrusion-detection), Windows can send events to the Windows event collector from remote machines. Not a reader? Watch this related video tutorial! **_Not seeing the video? Make sure your ad blocker is disabled._** ## Windows Event Log Forwarding Overview WEF is a service that allows you to forward events from multiple Windows servers and collect them in one spot. The service has two main components; a forwarder and a collector. A collector is a service running on a Windows server that collects all events sent to it from an event log forwarder. Related:[A Complete Guide to Using the Get-WinEvent PowerShell Cmdlet](https://adamtheautomator.com/get-winevent/) The “link” between the forwarding server and a collector is known as a subscription. Collectors serve as subscription managers that accept events and allow you to specify which event log alerts to collect from endpoints. ## WEF Project Overview This is a Project article where we cover how to build a project or implement a solution. Each section hereafter will be cumulative steps that build upon the previous. For this project, you’re going to learn how to set up a basic WEF implementation. You’ll learn how to set up both a collector and how to forward events to a collector with a subscription. You’ll learn how to: 1. Set up and configure an event log collector on a Windows Server instance. This will be the Windows Server that all of the event log forwarders will send events. 2. Create a GPO that, when applied, will point applicable Windows Server instances to the collector to send events to. 3. Configuring the types of events to send to the collector. You will learn how to work through each step in the remainder of this article. ## Environment and Knowledge Requirements Before you get too far, let’s first ensure my environment is the same as yours. Please be sure you have the following items in place before starting: * (2) Windows Server instances – You can use any Windows Server instance of 2012 R2 or higher. In this article, I’ll be using Windows Server 2016. * Active Directory * GPO – A familiarity with [Group Policy](https://adamtheautomator.com/what-is-group-policy/) Objects will be required. * WinRM- WinRM needs to be running on all clients. Not configured just running. Related: [What is Group Policy and How Does it Work? (In Detail)](https://adamtheautomator.com/what-is-group-policy/) ## Configuring the Windows Event Collector The first task to perform is configuring one of your Windows Server instances as the collector. Recall that the collector is the one that receives incoming event logs from the forwarder. ### Enabling WinRM on the Windows Event Collector Windows Server instances that forward events to the collector do so over [PowerShell Remoting](https://docs.microsoft.com/en-us/powershell/scripting/learn/remoting/running-remote-commands) or WinRM. You’ll first have to ensure WinRM is available on your collector. If the collector is running Windows Server 2012 R2 and above, WinRM is enabled by default, but the Windows Firewall may be interfering. Run the the `Enable-PSRemoting` PowerShell cmdlet with no parameters on the collector. Even if [PowerShell Remoting](https://adamtheautomator.com/psremoting/) is already enabled, it will skip the necessary steps. To be sure, you can also run `[Invoke-Command](https://adamtheautomator.com/invoke-command/) -ComputerName -ScriptBlock {1}` from a remote computer. If you don’t receive an error, PowerShell Remoting is working. ### Starting the Subscription Collector Service Now that PowerShell Remoting is enabled and listening, start the subscription collector service. The subscription collector service needs to also start up automatically when Windows Server boots up. On the collector, open _Event Viewer_ click on _Subscriptions_. The first time you open the _Subscriptions_ option, Windows will ask if you want to start the _Windows Event Log Collector Service_ and configured to start automatically. Click _Yes_ to accept. You can see an example of the message below. ![Windows Event Collector Service](/wp-content/uploads/2019/10/image.png) Windows Event Collector Service Congratulations! You now have a collector configured. It’s now time set up a GPO which will instruct Windows Server instances to forward events to the collector. ## Setting up the Forwarders’ GPO The next step is to configure one or more Windows servers to begin forwarding event logs to the collector. The easiest way to do so is by creating a GPO. This GPO can then be applied to one or more OUs which contain the servers to send events from. You’ll learn the basics of setting up the necessary settings in a GPO in this Project article. But if you’d like to a complete rundown with all the available options, check out the [Microsoft documentation](https://support.microsoft.com/en-us/help/323076/how-to-set-event-log-security-locally-or-by-using-group-policy). ### Allowing the Network Service to Read Event Logs WEF uses the [Network Service account](https://docs.microsoft.com/en-us/windows/win32/services/networkservice-account) to read and send events from a forwarder to a collector. By default, the Network Service account does not have access to do this. You’ll first need to set this ACL to allow it. _Note: Many of the event logs in Windows Server already provide the Network Service account access to the common event logs like Application and System. But the account is not given access to the Security event log and other custom event logs._ To allow the Network Service account to read event logs on event log forwarders, use a GPO. In this article, you’ll learn how to allow the Network Service account access to the Security event log. Other event logs will follow the same process. 1\. Begin by opening up a command prompt and running `wevtutil gl security`. This will provide various information about the Security event log. But the piece to pay attention to is the _channelAccess_ [SDDL](https://docs.microsoft.com/en-us/windows/win32/secauthz/security-descriptor-definition-language). You can see below an example of the SDDL you’ll need for the Security event log. The _channelAccess_ line represents the permissions set on the event log. Copy the SDDL highlighted below and save it somewhere for later to add to a GPO. ![channelAccess SDDL](/wp-content/uploads/2019/10/image-1.png) channelAccess SDDL 2\.  [Create a GPO](https://www.dell.com/support/article/us/en/04/sln283093/windows-server-how-to-create-and-link-a-group-policy-object-using-the-group-policy-management-console) via the Group Policy Management Console. Inside of the GPO, navigate to _Computer Configuration_ → _Policies_ → _Administrative Templates_ → _Windows Components_ → _Event Forwarding_ → _Configure target subscription manager_. 3\.  Set the value for the _target subscription manager_ to the WinRM endpoint on the collector. You will set the Server to be in the format: _Server=http://:5985/wsman/SubscriptionManager/WEC,Refresh=60_ > _Note the Refresh interval at the end of the collector endpoint. The Refresh interval indicates how often clients should check in to see if new subscriptions are available._ 4\.  Next, find the SDDL you copied earlier from running `wevtutil gl security` and paste it into the setting _Computer Configuration_ → _Policies_ → _Administrative Templates_ → _Windows Components_ → _Event Log Service_ → _Security_ → _Configure log access_. _Note that this SDDL will take precedence over all other permissions that have been configured for the event log._ You can see an example of what your GPO will look like below for the Security event log. ![Configure log access GPO setting](/wp-content/uploads/2019/10/image4_-2-.png) Configure log access GPO setting 5\.  Once the GPO is created, you’ll then either link this GPO to an existing OU containing the Windows servers to send event logs from or create a new OU and link the GPO. Any AD computer account you add to this OU will now set up a subscription to the collector. ## Setting up a Subscription While configuring WEF to collect all events for all Windows servers in an Active Directory domain may seem like a good idea, it’s not. You must be selective and only forward events that are important to you. Filtering out the noise from what matters is where WEF demonstrates its true value. Let’s work through setting up a subscription for the Security Event log. Since you’ve already created the GPO and linked it to an Active Directory OU containing the Windows servers you’d like to send events from, the event sources are already set up 1. On the collector, open the Windows Event Viewer and right-click on _Subscriptions, then create subscription_. ![Creating an event log subscription](/wp-content/uploads/2019/10/image3_-1-.png) Creating an event log subscription 2\.  As shown below, select the _Source computer initiated_ option and then click _Select Computer Groups_. This is where you will select which computers you’d like to forward events from. ![Setting an event log source](https://adamtheautomator.com/wp-content/uploads/2020/06/youd-like-to-forward-events-from.png) Setting an event log source > _Pro Tip: Selecting AD Groups. Ex: “Domain Controllers” will auto-populate any computers within the group. No need to select individual computers every time you add a new server._ 3\.  Next select the events to forward. Opening up the query filter as you can see below, select Security to forward events to the collector from the Security event log. ![Selecting Windows events to forward](https://adamtheautomator.com/wp-content/uploads/2020/06/Next-select-the-events-to-forward.-Opening-up-the-query-filter-as-you-can-see-below.png) Selecting Windows events to forward 4\.  Once the Security log is selected, you can filter down even more by entering the event ID, keywords, users and computers as shown below. ![Filtering Windows events](https://adamtheautomator.com/wp-content/uploads/2020/06/Once-the-Security-log-is-selecte.png) Filtering Windows events 5\.  Click OK to exit from the _Query Filter_. 6\.  Click _Advanced_ in the _Subscription Properties_ window. Now select _Minimize Latency_. This setting will ensure the collector will receive events as soon as possible and also to help it catch up if it gets behind. ![Setting Minimize Latency](https://adamtheautomator.com/wp-content/uploads/2020/06/Click-Advanced-in-the-Subscription-Properties-window.-Now-select-Minimize-Latency.-Th.png) Setting Minimize Latency ## Verifying the WEF Configuration Once WEF is set up, you should now check to see if the forwarders actually checked in by checking the Source Computers column on the main Subscriptions page. ![Event Log subscriptions](https://adamtheautomator.com/wp-content/uploads/2020/06/Verifying-the-WEF-Configuration.png) Event Log subscriptions You can also check the Event Forwarding Plugin Operational log under Applications and Services on the client to make sure everything is working. This is where you’ll see descriptive errors if something has gone awry with Kerberos or firewalls. ![EventLog-ForwardingPlugin event](https://adamtheautomator.com/wp-content/uploads/2020/06/has-gone-awry-with-Kerberos-or-firewalls.-1024x711.png) EventLog-ForwardingPlugin event All that is left to to is find a low-value client, clear the Security log and see if you get an alert. ## Your Takeaways In this Project, you learned how to set up a basic WEF subscription. You: * Set up an event collector * Created a GPO to create a subscription on various Windows Server forwarders * Configured a WEF subscription to only send specific events * Ensured the WEF subscription sent events as fast as possible WEF is a bit tricky to configure initially, but once up and running, you should have little problems and minimal maintenance headaches. Share this article [Share on X](https://twitter.com/intent/tweet?url=https%3A%2F%2Fadamtheautomator.com%2Fwindows-event-collector%2F&text=Efficient%20Windows%20Event%20Collector%20Setup%20%26%20Configuration)[Share on Facebook](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fadamtheautomator.com%2Fwindows-event-collector%2F)[Share on LinkedIn](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fadamtheautomator.com%2Fwindows-event-collector%2F) ## Related Posts ![](https://adamtheautomator.com/wp-content/uploads/2020/08/Untitled-design-4.png) ### [Disabling Windows Firewall: A Comprehensive Guide](/disable-windows-firewall/) Learn various methods to disable the Windows firewall, including GUI tools, PowerShell, command-line, and group policy. ![](https://adamtheautomator.com/wp-content/uploads/2026/08/5136_featured_image.webp) ### [Setting Up a Custom NuGet Server in IIS on Windows Server](/nuget-server/) Learn how to set up a custom NuGet server in IIS on Windows Server with this hands-on, example-driven tutorial. ![](https://adamtheautomator.com/wp-content/uploads/2020/01/suit-673697_1920.jpg) ### [Master NIC Teaming with PowerShell and GUI](/nic-teaming/) Learn about NIC Teaming, its benefits, and how to deploy it using PowerShell or GUI. Improve your networking skills and VM performance. ## Categories * [IT Ops](/category/it-ops/) * [Cloud](/category/cloud/) * [DevOps](/category/devops/) * [Home Ops](/category/home-ops/) * [Information Security](/category/infosec/) * [Software Development](/category/software-development/) ## Site * [Home](/) * [Tutorials](/tutorials/) * [Instructors](/author/) * [Advertising](/advertising/) * [Recommended Resources](/resources/) * [About Adam](/about-adam/) Copyright 2026© ATA Learning | [Privacy Policy](/privacy/)