How to Configure Windows Event Forwarding to a Collector
Applies to: Windows Server 2019, 2022 and 2025.
Windows Event Forwarding sends selected events from source computers to a central collector using WinRM and subscriptions.
Monitoring should collect enough evidence to diagnose trends without overwhelming storage or exposing sensitive logs. Visit networkmanager.info.
Prerequisites
- Choose collector and retention.
- Define source groups.
- Configure WinRM.
- Select targeted events.
Procedure
Step 1: Initialize collector
Run on WEC server.
wecutil qcStep 2: Configure source policy
Set Subscription Manager under Event Forwarding in Group Policy.
Step 3: Create subscription
Choose Source computer initiated and authorize the AD group.
Step 4: Define query
Start with targeted security and system event IDs.
Step 5: Refresh clients
Apply policy and test transport.
gpupdate /force
Test-WSMan collector.corp.exampleStep 6: Monitor log
Inspect ForwardedEvents.
Verification
Check subscription status and received events.
wecutil gr 'Server Security Events'
Get-WinEvent -LogName ForwardedEvents -MaxEvents 50Rollback
Disable the subscription and unlink the source GPO while preserving collected evidence.
Operational notes
Protect collector permissions so sources cannot alter centralized evidence.
Official references
Explore Netcloud24 Canada.
