Windows Event Forwarding: a source-initiated subscription, wecutil, and the EventLog Readers group

Goal

Collect Windows event log entries from many source computers onto one collector, using a source-initiated subscription so new computers can be added by policy rather than by editing the subscription on the collector for each one.

Prerequisites

Administrative access on the collector and on each source; for the Kerberos-based setup below, all computers in the same Active Directory domain (sources outside the domain need a separate certificate-based setup); WinRM configured on the collector and on each source (winrm qc -q, as in Microsoft's instructions).

Steps

1. On the collector, enable the Windows Event Collector service: wecutil qc /q:true (the /q:true flag skips the interactive confirmation, needed for unattended runs).
2. Author a subscription XML file describing a source-initiated subscription: SubscriptionType set to SourceInitiated, a ConfigurationMode (Normal, Custom, MinLatency or MinBandwidth), a Query selecting the channel and criteria, and AllowedSourceDomainComputers, an SDDL security descriptor naming who may forward. Per Microsoft's documentation, if it is left empty the default O:NSG:NSD:(A;;GA;;;DC)(A;;GA;;;NS) grants all Domain Computers.
3. Create the subscription on the collector: wecutil cs subscription.xml. wecutil gs <SubscriptionID> then displays that subscription's stored configuration, and wecutil gr <SubscriptionID> (get-subscriptionruntimestatus) displays the live runtime status of each source computer in it.
4. Point source computers at the collector via Group Policy: Computer Configuration > Administrative Templates > Windows Components > Event Forwarding > "Configure target Subscription Manager", with a value such as Server=http://<collector FQDN>:5985/wsman/SubscriptionManager/WEC,Refresh=60. Apply the policy and run gpupdate /force on a source to confirm.
5. To forward the Security log specifically, the documentation states that the NETWORK SERVICE account must be added to the EventLog Readers group; do this on every source computer, since the forwarder runs as that account and otherwise cannot read that channel. The new membership usually takes effect only after the source (or at least its WinRM service) restarts.
6. On the collector, forwarded events land in the "ForwardedEvents" log by default (unless the subscription specifies a different destination log). Check them with Get-WinEvent -LogName ForwardedEvents -MaxEvents 20.

Expected result

wecutil gr <SubscriptionID> on the collector shows each source with an active runtime status; Get-WinEvent -LogName ForwardedEvents returns recent events tagged with the originating computer name.

Limits and test basis

Based on Microsoft Learn's documentation on source-initiated subscriptions, wecutil, and Windows Event Collector. To undo, delete the subscription (wecutil ds <SubscriptionID>) and revert the Group Policy object; sources stop forwarding once the policy no longer names the collector. A source missing from the EventLog Readers group will forward other channels normally while silently omitting Security events — check that group membership first when Security events are missing on the collector.