Windows Event Forwarding at Scale

This video shows how organizations can implement Windows Event Forwarding so that logs can be shipped from Windows endpoints to Windows Event Collectors. The video is a full walkthrough showing how to configure each component. In addition, it includes advanced topics such as the Windows Event Collector subscription registry keys and how to assign computers to multiple collectors dynamically.

If you are tasked with collecting logs from numerous Windows endpoints, and you want to get away from installing log agents, this video is for you.

These commands were run within PowerShell on the collector.

winrm quickconfig -quiet
2Set-Service -Name WINRM -StartupType Automatic
3wevtutil sl forwardedevents /ms:1000000000

These commands were run within cmd.exe on the collector.

netsh http delete urlacl url=http://+:5985/wsman/
netsh http add urlacl url=http://+:5985/wsman/ sddl=D:(A;;GX;;;S-1-5-80-569256582-2953403351-2909559716-1301513147-412116970)(A;;GX;;;S-1-5-80-4059739203-877974739-1245631912-527174227-2996563517)
netsh http delete urlacl url=https://+:5986/wsman/
netsh http add urlacl url=https://+:5986/wsman/ sddl=D:(A;;GX;;;S-1-5-80-569256582-2953403351-2909559716-1301513147-412116970)(A;;GX;;;S-1-5-80-4059739203-877974739-1245631912-527174227-2996563517)

Below are the ACLs referenced within group policy.

O:BAG:SYD:(A;;0xf0005;;;SY)(A;;0x5;;;BA)(A;;0x1;;;S-1-5-32-573)(A;;0x1;;;NS)
O:BAG:SYD:(A;;0xf0005;;;SY)(A;;0x5;;;BA)(A;;0x1;;;S-1-5-32-573)(A;;0x1;;;S-1-5-20)

The subscription manager string in GPO entered was as below. Make sure to change wecdemo.labmeinc.int to be your WEC server host FQDN.
Server=http://wecdemo.labmeinc.int:5985/wsma...

Lastly, the Data Collection at Scale course referenced can be found below.

https://mycyber.training/courses/data...

From now until the end of August 2021, use the coupon code 3nsy7z4s to receive $100 off. If you are outside the US or work for an industry without funding and need assistance affording the class, please reach out to [email protected].