Cyber Security

Active Directory: Configuring Event Log Subscriptions (Forwarding)

Event Viewer enables you to view events and logs on your computer. And troubleshooting an issue might require to view log files from other remote computers. Event Log Subscriptions comes into play … Subscription enables you to save events from remote computers. In this article I am going to configure a collector and a target system.

Suppose you want to collect event log events from your domain controller on your client computer. Therefore your client computer is the collector und your domain controller is the target.

Client Computer (Collector)

Log on to your client computer (Windows Vista and above) with an account which is member of the domain admins group. Open Windows PowerShell and type wecutil qc. Hit enter.

wecutil qc

Unbenannt.PNG

This will start the Event Collector Service.

Server Computer (Target System)

On Windows Server 2012 and 2016 Remote Management is enabled by default. Just to make sure it’s enabled, type


Configure-SMRemoting.exe -GET

Unbenannt.PNG

If Remoting is not enabled you can simply enable it by running


Configure-SMRemoting.exe -ENABLE

Unbenannt.PNG

Before we go to the next step open Server-Manager and make sure Remote Management is set to Enabled.

1.PNG

Now we have to add the collector’s computer account to the server’s Event Log Reader Group. You can do it either in cmd or PowerShell.


Add-ADGroupMember -Identity "Event Log Readers" -Members "client01$"

1.PNG


net localgroup "Event Log Readers" sid-500\client01$ /add

2.PNG

This will add client01 to the Event Log Readers Group. We are now ready to configure the main part.

Configuring Event Log Subscriptions

Log on to your collector computer (Windows 10). Open Event Viewer (eventvwr). Click Subscriptions and select Create Subscription.

Unbenannt.PNG

Enter a Subscription Name and click on Select Computers.

Unbenannt.PNG

Click Add Domain Computers and type the computer name of your target system. It makes sense to test the connection before continue.

Unbenannt.PNG

Unbenannt.PNG

Next click Select Events.

Unbenannt.PNG

Define a Query Filter. Select the events you want to collect.

Unbenannt.PNG

Click OK.

Testing the functionality of Event Log Subscriptions

Wait a few minutes and do something on your target system. For example, restart the computer to trigger event log entries. Then go back to your client system and click on Windows Logs. Select Forwarding Events and review the logs of your target computer.

Unbenannt.PNG

Nice. This completes the forwarding configuration.

Configure Advanced Settings

But there’s more. You can configure Bandwith, Latency and more … Go back to your recently configured subscription and double-click on it. Select Advanced.

Unbenannt.PNG

Pay attention to the Event Delivery Optimization.

Unbenannt.PNG

Using normal mode 5 items at a time are delivered. It’s a bit tricky to find a suitable setting that meets your requirement. I recommend reading the Official Microsoft article:

https://technet.microsoft.com/en-us/library/cc749167%28v=ws.11%29.aspx?f=255&MSPPError=-2147217396

Have fun playing with Event Log Subscriptions!

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google+ photo

You are commenting using your Google+ account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s