How to Configure Windows Event Forwarding Subscriptions in Windows 11 Using PowerShell

In enterprise cybersecurity operations, centralising endpoint event telemetry—such as security logons, PowerShell execution logs, process creation events (Event ID 4688), and Defender antivirus alerts—is crucial for rapid incident detection. While many environments deploy third-party SIEM agents, Windows includes an enterprise-grade, agentless event aggregation mechanism built into the operating system: Windows Event Forwarding (WEF). Operating over standard Windows Remote Management (WinRM) and WS-Management protocols, WEF allows a central collector machine to aggregate logs from hundreds of Windows 11 client endpoints using PowerShell.

Understanding Windows Event Forwarding Architecture

Windows Event Forwarding operates through two primary deployment topologies:

• Collector-Initiated Subscriptions: The central collector workstation or server contacts client computers over WinRM, establishes a persistent listener, and pulls specified event logs. Best suited for smaller networks or staging lab environments.
• Source-Computer-Initiated Subscriptions: Client machines are configured via Group Policy or Intune with the collector’s FQDN. The clients establish outbound connections to the collector and push logs. This model scales efficiently to thousands of endpoints.
• Security Forwarding Channel: Forwarded events are written directly to the dedicated ForwardedEvents.evtx log channel on the collector, ready for parsing or SIEM ingestion.

Configuring WinRM and Collector Services via PowerShell

To prepare both client machines and the central collector, initialize Windows Remote Management and the Windows Event Collector service:

Step 1: On Client Workstations

# Enable WinRM service and configure firewall rules
Enable-PSRemoting -Force

# Start WinRM and configure automatic startup
Set-Service -Name "WinRM" -StartupType Automatic
Start-Service -Name "WinRM"

# Grant Network Service read permissions to Security Event Log
wevtutil sl Security /ca:'O:BAG:SYD:(A;;0xf0005;;;SY)(A;;0x5;;;BA)(A;;0x1;;;S-1-5-32-573)(A;;0x1;;;NS)'

Step 2: On the Collector Machine

# Enable Windows Event Collector service
wecutil qc /q

# Verify collector service state
Get-Service -Name "Wecsvc"

Creating an Event Subscription Using PowerShell and XML

Subscribed events are defined via an XML configuration file specifying the source machines, query filters, and transmission latency. Create a subscription configuration file named SecurityEvents.xml:

<Subscription xmlns="http://schemas.microsoft.com/2006/03/windows/events/subscription">
  <SubscriptionId>SecurityLogonEvents</SubscriptionId>
  <SubscriptionType>CollectorInitiated</SubscriptionType>
  <Description>Forward Security Logon and Process Creation Events</Description>
  <Enabled>true</Enabled>
  <Uri>http://schemas.microsoft.com/wbem/wsman/1/windows/EventLog</Uri>
  <ConfigurationMode>MinLatency</ConfigurationMode>
  <Query>
    <![CDATA[
      <QueryList>
        <Query Id="0" Path="Security">
          <Select Path="Security">*[System[(EventID=4624 or EventID=4625 or EventID=4688)]]</Select>
        </Query>
      </QueryList>
    ]]>
  </Query>
  <Address>win11-client01.corp.local</Address>
  <Address>win11-client02.corp.local</Address>
</Subscription>

Deploying and Activating the Subscription via wecutil

Register the subscription on the collector machine using the wecutil command-line utility:

# Create the subscription
wecutil cs SecurityEvents.xml

# Verify subscription status
wecutil gr SecurityLogonEvents

The status output confirms the operational state (Active: true) and lists connection statuses for each target address.

Querying Forwarded Events on the Collector

Once clients generate targeted events (e.g. logon sessions or new process executions), query the ForwardedEvents log using PowerShell:

# Query the most recent forwarded events
Get-WinEvent -LogName "ForwardedEvents" -MaxEvents 10 | Select-Object TimeCreated, Id, MachineName, Message | Format-Table -AutoSize

Each entry preserves the original client MachineName, event ID, and timestamp, giving security analysts comprehensive visibility without installing third-party agent software.

Configuring Windows Event Forwarding subscriptions via PowerShell establishes a lightweight, native telemetry pipeline that fortifies enterprise threat detection across Windows 11 environments.