Windows Event Forwarding (WEF) allows administrators to collect and forward event logs from client computers to a central server. While useful for centralized logging and SIEM integration, organizations not utilizing WEF should disable it to reduce background overhead and minimize the attack surface. This guide explains how to completely disable Event Forwarding via Group Policy in Windows 11.
Prerequisites
You must have administrative privileges to modify Group Policy settings on the target Windows 11 machine.
Disable Event Forwarding Using Group Policy
Open the Group Policy Editor
Press the Windows Key + R, type gpedit.msc, and hit Enter to launch the Local Group Policy Editor.
Navigate to the Event Forwarding Policies
In the left pane, navigate to Computer Configuration > Administrative Templates > Windows Components > Event Forwarding.
Locate the Subscription Manager Policy
In the right pane, find the policy named Configure target Subscription Manager and double-click it.
Disable the Policy
Change the setting to Disabled. Click Apply, then OK to save your configuration.
Force a Policy Update
Open an elevated Command Prompt and execute gpupdate /force to apply the Group Policy changes immediately.
Verify the Configuration
To verify that Event Forwarding is disabled, open the Services console (services.msc) and ensure the Windows Event Collector service is stopped and set to Manual or Disabled. Additionally, review the Event Viewer under Subscriptions to ensure no active forwarding subscriptions exist.