--- title: "Prerequisites for WEC" canonical: "https://docs.infoblox.com/space/UniversalAssetInsights/1835925539/Prerequisites%20for%20WEC" format: markdown --- A Windows Event Collector (WEC) is a Windows server that centralizes event logs from other computers, called forwarders. It uses Windows Event Forwarding (WEF) to receive events via the WS-Management protocol over HTTP/HTTPS, stores them in its local event logs, and can then be used by security tools for monitoring. This allows administrators to collect logs from many machines in one place without needing a separate agent on each one.  > ℹ️ WEC is a product developed by Microsoft; so, for direct support inquiries, it’s best to reach out to Microsoft. Infoblox is here to help whenever we can and will provide assistance as appropriate. For more information about WEC, see *[Windows Event Collector](https://learn.microsoft.com/en-us/windows/win32/wec/windows-event-collector)*[.](https://learn.microsoft.com/en-us/windows/win32/wec/windows-event-collector) ### **Manual Steps**  1. Log on to the WEC server as a domain admin and ensure it is domain-joined. 2. Install Windows Event Collector via Server Manager → Features → Windows Event Collector. 3. Open services.msc → Windows Event Collector → set Startup = Automatic (Delayed Start), start the service. 4. Run 'wecutil qc' in elevated PowerShell. Press Y when prompted. 5. Run 'winrm enumerate winrm/config/listener' to confirm HTTP/5985 listener. 6. Register HTTP SPNs for Kerberos: `setspn -S HTTP/ $ ` `setspn -S HTTP/ $ ` `Example:  ` `setspn -S HTTP/WEC01 CONTOSO\WEC01$ ` `setspn -S HTTP/WEC01.contoso.com CONTOSO\WEC01$ `   In this example:    **What these commands do**  - **First line**: Registers the **NetBIOS name** (WEC01) as an HTTP SPN on the computer account CONTOSO\WEC01$. - **Second line**: Registers the **Fully Qualified Domain Name (FQDN)** ([WEC01.contoso.com](http://WEC01.contoso.com)) as an HTTP SPN on the same computer account. - The -S switch ensures the SPN is added safely (it will fail if a duplicate exists, preventing Kerberos conflicts). - The $ at the end of WEC01$ indicates it’s the **computer account** in Active Directory, not a user. Together, these entries allow Kerberos to resolve authentication requests for either the short name or the FQDN when clients connect to the collector via WinRM/WSMan.  7. Increase Forwarded Events log size in **Event Viewer > Properties >** set to at least 1024 MB. **Alternative Automation Script (run on the WEC server)**  ` ` `Import-Module ServerManager ` ` ` `# Variables ` `$CollectorHostName = COMPUTERNAME ` `$CollectorFQDN     = [System.Net.Dns]::GetHostEntry($env:COMPUTERNAME).HostName ` `$ForwardedLogSizeMB = 1024 ` ` ` `# Install Event Collector feature if missing ` `if (-not (Get-WindowsFeature EventCollector).Installed) { ` `    Add-WindowsFeature EventCollector | Out-Null ` `} ` ` ` `# Quick-config collector ` `wecutil qc /q ` ` ` `# Ensure WinRM listener exists ` `winrm enumerate winrm/config/listener | Out-Null ` ` ` `# Ensure HTTP SPNs ` `$spns = (setspn -L $CollectorHostName) 2>$null ` `$needed = @("HTTP/$CollectorHostName","HTTP/$CollectorFQDN") ` `foreach ($spn in $needed) { ` `    if ($spns -notmatch [regex]::Escape($spn)) { ` `        setspn -S $spn "$CollectorHostName$" | Out-Null ` `    } ` `} ` ` ` `# Increase ForwardedEvents size ` `$log = Get-WinEvent -ListLog ForwardedEvents -ErrorAction Stop ` `if ($log.MaximumSizeInBytes -lt ($ForwardedLogSizeMB * 1MB)) { ` `    wevtutil sl ForwardedEvents /ms:($ForwardedLogSizeMB * 1MB) ` `} `   ## Creating the Subscription ### Manual Steps  1. Click **Subscription** in the Event Viewer. Go to **Event Viewer > Subscriptions > Create Subscription... ** 2. Specify a name and choose **Source computer initiated**. 3. Authorize the Microsoft Active Directory server to push logs to this computer. Click the **Select Computer Groups** button on the previous step. Click on the **Add Domain Computers** button. - Specify the Microsoft Active Directory server name as **/ ** or **/** and click **Check Name.** Click **Ok**.` ` - After you click OK, the** Computer Groups** screen will be shown as below: 4. Select events to collect. Click the **Select Events** button on the dialog shown in step 2. Click the **XML** tab and add the following query to the text area: ` ` `   ` `     ` `   ` ` `    5. Choose **Minimize Latency**. Click on **Advanced **button on the dialog shown in step 2. 6. You will see 0 (zero) source computers in newly created subscription. It is expected because we have not configured our Microsoft Active Directory server to forward events to this WEC computer. 7. Once the subscription is active, view the number of domain controllers forwarding events by clicking **Runtime Status**. ### **Alternative Automation Script (run on WEC)**  ` ` `$SubscriptionName = "MSADLogonlogoffevents" ` `$SubscriptionXmlPath = "$env:TEMP\WEF_Subscription.xml" ` ` ` `$xml = @" ` ` ` `  $SubscriptionName ` `  SourceInitiated ` `  Capture DC logon/logoff events ` `  http://schemas.microsoft.com/wbem/wsman/1/windows/EventLog ` `  MinLatency ` `   ` `    30000 ` `   ` `   ` `       ` `         ` `       ` `     ` `  ]]> ` `  true ` `  HTTP ` `  RenderedText ` `  en-US ` `  ForwardedEvents ` ` ` `"@ ` ` ` `$Utf8NoBom = New-Object System.Text.UTF8Encoding($false) ` `[System.IO.File]::WriteAllText($SubscriptionXmlPath, $xml, $Utf8NoBom) ` ` ` `try { wecutil gs $SubscriptionName | Out-Null; wecutil ds $SubscriptionName } catch {} ` `wecutil cs $SubscriptionXmlPath `   ## **Configure Domain Controllers via GPO**  ### **Manual Steps**  1. Open **GPMC > Domain Controllers OU >** Create/Link GPO 'Windows Event log collection'. 2. Group Policy Management Editor: **Computer > Administrative Templates > Windows Components > Event Forwarding**. 3. Edit: Configure target Subscription Manager > Enabled > add:  `Server=http://:5985/wsman/SubscriptionManager/WEC,Refresh=10 ` 4. Edit: Event Log Service > Security > Configure log access > Enabled > paste SDDL:  `O:BAG:SYD:(A;;0xf0005;;;SY)(A;;0x5;;;BA)(A;;0x1;;;S-1-5-32-573)(A;;0x1;;;S-1-5-20) ` 5. Edit: System Services > Windows Remote Management (WS-Management)> Define > Startup mode = Automatic. ### **Alternative Automation Script ** This is for a quick test of the Domain Controller. Production environments must use GPO. ` ` `$CollectorFQDN = "" ` `$base = "HKLM:\Software\Policies\Microsoft\Windows\EventLog\EventForwarding\SubscriptionManager" ` `New-Item -Path $base -Force | Out-Null ` `New-ItemProperty -Path $base -Name "1" -Value "Server=http://$CollectorFQDN:5985/wsman/SubscriptionManager/WEC,Refresh=10" -PropertyType String -Force | Out-Null ` ` ` `$secKey = "HKLM:\Software\Policies\Microsoft\Windows\EventLog\Security" ` `New-Item -Path $secKey -Force | Out-Null ` `New-ItemProperty -Path $secKey -Name "ChannelAccess" -Value "O:BAG:SYD:(A;;0xf0005;;;SY)(A;;0x5;;;BA)(A;;0x1;;;S-1-5-32-573)(A;;0x1;;;S-1-5-20)" -PropertyType String -Force | Out-Null ` ` ` `Set-Service WinRM -StartupType Automatic ` `Start-Service WinRM ` ` ` `gpupdate /force | Out-Null ` ## Creating a Group Policy  1. Open **Server Manager.** 2. Open **Group Policy Management: ** Go to **Tools > Group Policy Management**. 3. Create a GPO for your domain or use the appropriate existing policy. Right-click on your domain and click **Create a GPO in this domain, and link it here..** This should be done on the Domain Controllers OU unless you intend to collect logon events from every system, which is not advisable. 4. Specify a name and click **OK**. 5. Right-click on newly created GPO and click edit. 6. Add **Event Log Readers g**roup in Restricted group. In **Group Policy Management Editor**, go to **Computer Configuration > Policies > Windows Settings > Restricted Groups**. Right-click on empty space and click **Add Group**. - Click **Browse** for the **Event Log Readers**. - And then add **NT AUTHORITY\Network Service** 7. Define Windows Remote Management. In **Group Policy Management Editor**, go to **Computer Configuration > Policies > Windows Settings> System Services**. Find and double-click **Windows Remote Management**. Click **Define this policy setting** checkbox and select **Automatic Option**. Windows Remote Management will start automatically when the computer restarts. 8. Configure Event Forwarding. In **Group Policy Management Editor**, go to **Computer Configuration > Policies > Administrative Templates > Windows Components > Event Forwarding**. - Double-click on **Configure forwarder resource usage **and then select **Enable **option and specify the maximum forwarding rate. - Double-click **Configure target Subscription Manager** and select **Enable. **Click **Show**. It will show the following pop-up: - Specify the following text in the text box: `Server=http://[FQDN of the server where the WEC is installed]/wsman/SubscriptionManager/WEC,Refresh=10`. This URL contains the FQDN of the WEC computer. 9. Configure log access.Go to **Computer Configuration > Policies > Windows Components > Event Log Service > Security**. - Double click on **Configure log access.** ## Updating the Group Policy via Command Line  1. Open CMD as administrator. 2. Run `gpupdate /force` command. ## Checking Forwarder Events on WEC  1. Open **Event Viewe**r. 2. Click **Subscription**. You should see one source computer. 3. Click **Forwarded Events**. Go to Windows Logs > Forwarded Events. You should see forwarded events.