How to Set Up Windows Event Forwarding (WEF) to Centralize Security Logs

The WEC server receives and stores forwarded events. It should be a dedicated Windows Server (not a domain controller: keep collection infrastructure separate from critical AD infrastructure).

# On the WEC server (run as Administrator)

# 1. Enable the Windows Event Collector service
wecutil qc -quiet  # Quick configure: enables the WEC service and sets it to auto-start

# 2. Verify the service is running
Get-Service -Name Wecsvc | Select-Object Status, StartType

# 3. Enable WinRM (required for receiving events)
winrm quickconfig -quiet

# 4. Add the WEC server's computer account to the Network Service group
# (or configure the WEF subscription to use a specific service account)
# The default configuration uses the Network Service account

# 5. Expand the Security event log size to handle volume
# Default is 20MB: increase for a log collector
wevtutil sl Security /ms:512000000  # 512MB
wevtutil sl "Forwarded Events" /ms:1073741824  # 1GB for the forwarded log
wevtutil sl "Forwarded Events" /rt:true  # Enable retention (don't overwrite)

WEC server sizing guide:

Group Policy pushes WEF configuration to all domain-joined machines: they then contact the WEC server and subscribe to the event forwarding subscription.

Create a new GPO for WEF (apply to all machines or a target OU):

GPO Path 1: Allow WinRM for event forwarding:
Computer Configuration > Preferences > Control Panel Settings >
Services > Windows Remote Management (WS-Management)
  Startup type: Automatic
  Service action: Start

GPO Path 2: Configure the WEC server address:
Computer Configuration > Administrative Templates >
Windows Components > Event Forwarding >
"Configure the server address, refresh interval, and issuer certificate authority"
  Server address: Server=http://wec-server.corp.local:5985/wsman/SubscriptionManager/WEC,Refresh=60
  (Use https:// and port 5986 for encrypted transport: requires certificate configuration)

GPO Path 3: Add Network Service to Event Log Readers:
Computer Configuration > Windows Settings > Security Settings >
Restricted Groups
Add: NETWORK SERVICE as member of Event Log Readers
(Required so the WinRM listener can read Security logs, which require elevated access)

PowerShell to verify WEF configuration on a source machine:

# On any domain machine after GPO applies (gpupdate /force)
Get-WinEvent -LogName 'Microsoft-Windows-Forwarding/Operational' -MaxEvents 10
# Should show successful subscription events

# Check WinRM is running
Get-Service WinRM

# Check the subscription is active
wecutil gs *  # List subscriptions the machine is enrolled in

Subscriptions define which events get forwarded. Use XPath filters to select only security-relevant events: forwarding everything is expensive and noisy.

Create a subscription on the WEC server:

<!-- Save as security-subscription.xml on the WEC server -->
<Subscription xmlns="http://schemas.microsoft.com/2006/03/windows/events/subscription">
  <SubscriptionId>Security-High-Value</SubscriptionId>
  <SubscriptionType>SourceInitiated</SubscriptionType>
  <Description>High-value security events from all domain machines</Description>
  <Enabled>true</Enabled>
  <Uri>http://schemas.microsoft.com/wbem/wsman/1/windows/EventLog</Uri>
  <ConfigurationMode>MinLatency</ConfigurationMode>
  <Delivery Mode="Push">
    <Batching>
      <MaxItems>100</MaxItems>
      <MaxLatencyTime>30000</MaxLatencyTime>  <!-- 30 seconds -->
    </Batching>
    <PushSettings>
      <Heartbeat Interval="3600000"/>  <!-- 1 hour heartbeat -->
    </PushSettings>
  </Delivery>
  <Query>
    <![CDATA[
    <QueryList>
      <Query Id="0">
        <!-- Security events: logon, logoff, process creation, account management -->
        <Select Path="Security">
          *[System[EventID=4624 or EventID=4625 or EventID=4634 or EventID=4648
                   or EventID=4662 or EventID=4672 or EventID=4688 or EventID=4698
                   or EventID=4702 or EventID=4720 or EventID=4726 or EventID=4728
                   or EventID=4732 or EventID=4740 or EventID=4756 or EventID=4768
                   or EventID=4769 or EventID=4776 or EventID=7045]]
        </Select>
        <!-- System events: new service, driver loaded -->
        <Select Path="System">
          *[System[EventID=7045 or EventID=7036 or EventID=7040]]
        </Select>
        <!-- PowerShell Script Block Logging -->
        <Select Path="Microsoft-Windows-PowerShell/Operational">
          *[System[EventID=4104]]
        </Select>
        <!-- Sysmon (if deployed) -->
        <Select Path="Microsoft-Windows-Sysmon/Operational">*</Select>
        <!-- WMI activity -->
        <Select Path="Microsoft-Windows-WMI-Activity/Operational">
          *[System[EventID=5857 or EventID=5858 or EventID=5859 or EventID=5860 or EventID=5861]]
        </Select>
      </Query>
    </QueryList>
    ]]>
  </Query>
  <ReadExistingEvents>false</ReadExistingEvents>
  <TransportName>HTTP</TransportName>
  <ContentFormat>RenderedText</ContentFormat>
  <Locale Language="en-US"/>
  <LogFile>ForwardedEvents</LogFile>
  <AllowedSourceDomainComputers>O:NSG:NSD:(A;;GA;;;DC)(A;;GA;;;NS)</AllowedSourceDomainComputers>
</Subscription>

# Create the subscription on the WEC server
wecutil cs C:\subscriptions\security-subscription.xml

# Verify the subscription is active
wecutil gs Security-High-Value

# Check subscription runtime status
wecutil gr Security-High-Value
# Shows: number of active sources, last error, etc.

NSA/Palantir recommended subscription sets: The NSA and Palantir have published WEF subscription files optimized for security monitoring at:

• https://github.com/nsacyber/Event-Forwarding-Guidance
• https://github.com/palantir/windows-event-forwarding

These include pre-built XPath queries for the most security-relevant event categories, organized into baseline, verbose, and custom tiers.

The WEC server's 'Forwarded Events' log can be read by any log shipper and forwarded to your SIEM.

Option 1: Winlogbeat (Elastic Stack)

# winlogbeat.yml on the WEC server
winlogbeat.event_logs:
  - name: ForwardedEvents
    ignore_older: 72h
    event_id: 4624, 4625, 4648, 4662, 4688, 4720, 4728, 4740, 4769
    processors:
    - add_fields:
        target: ''
        fields:
          source_type: wef_collected

output.elasticsearch:
  hosts: ["https://elasticsearch:9200"]
  index: "wef-security-%{+yyyy.MM.dd}"

Option 2: NXLog (flexible, multi-destination)

<!-- nxlog.conf on the WEC server -->
<Input in_wef>
  Module im_msvistalog
  Query <QueryList><Query Id='0'><Select Path='ForwardedEvents'>*</Select></Query></QueryList>
</Input>

<Output out_syslog>
  Module om_udp
  Host 10.0.1.50
  Port 514
  Exec to_syslog_bsd();
</Output>

<Route route1>
  Path in_wef => out_syslog
</Route>

Option 3: Microsoft Sentinel (Azure Monitor Agent on WEC)

# Install Azure Monitor Agent on WEC server
# Configure Data Collection Rule in Azure portal:
# Monitor > Data Collection Rules > Create
# Source: Windows Event Logs > ForwardedEvents channel
# Destination: Log Analytics workspace

Verify end-to-end flow:

# On any domain machine, trigger a test event
Write-EventLog -LogName Security -Source 'WEF-Test' -EventId 4624 -Message 'WEF test event'

# On WEC server, verify the event arrived
Get-WinEvent -LogName 'ForwardedEvents' -MaxEvents 5 | Select-Object TimeCreated, Id, Message

# In SIEM, search for the test event: confirm it arrived within the MaxLatencyTime window