How to Configure and Manage Windows Event Forwarding (WEF) Subscriptions Using wecutil in Windows 11

Centralised security monitoring and rapid incident triage across enterprise workstation fleets require continuous visibility into local operating system events. While enterprise SIEM (Security Information and Event Management) platforms frequently deploy proprietary endpoint telemetry agents, Windows 11 incorporates a native, robust, and highly efficient event aggregation architecture known as Windows Event Forwarding (WEF). Operating over the standard WS-Management protocol via Windows Remote Management (WinRM), WEF allows collector servers to aggregate event logs from hundreds of client endpoints without third-party software. At the administrative core of WEF management resides wecutil.exe, a versatile command-line utility. Mastering wecutil enables systems engineers and security analysts to script subscription deployments, audit subscription runtimes, and troubleshoot delivery latency across modern Windows environments.

Understanding Windows Event Collector (WEC) Subscriptions and Topology

Windows Event Forwarding relies on two distinct operational architectures: collector-initiated subscriptions and source-initiated subscriptions. In collector-initiated models, the collector server establishes outbound WinRM connections to designated endpoint IP addresses and queries local event logs. However, in enterprise environments containing dynamic DHCP addressing, mobile laptops, and strict host firewalls, the source-initiated model is universally preferred.

In a source-initiated subscription, client workstations running Windows 11 receive Group Policy directives instructing them to periodically contact a designated Windows Event Collector (WEC) endpoint over TCP port 5985 (HTTP) or 5986 (HTTPS). Upon establishing communication, the Windows 11 client downloads an XML-based query filter and begins streaming matching security, system, or operational log entries directly to the collector’s ForwardedEvents log buffer.

Initialising the Windows Event Collector Service Environment

Before configuring or managing subscription files using wecutil, the collector workstation or server must have its event forwarding infrastructure initialised and its service dependencies configured to run automatically.

1. Click the Start button, type cmd, right-click Command Prompt, and select Run as administrator.
2. Execute the following command to configure the Windows Event Collector service to start automatically and create the necessary HTTP listener bindings:

   wecutil qc /q

3. Next, verify that the Windows Remote Management (WinRM) service is fully operational and configured to accept inbound traffic:

   winrm quickconfig -q

4. Ensure that local or domain firewall profiles permit inbound traffic on the designated WinRM port by verifying the active rule state:

   netsh advfirewall firewall show rule name="Windows Remote Management (HTTP-In)"

Authoring a Source-Initiated WEF Subscription XML Definition

The wecutil command imports subscriptions using structured XML configuration files. Below is an enterprise-grade XML template designed to collect high-priority Security log events (such as Process Creation Event ID 4688 and Account Lockout Event ID 4740) from domain-joined Windows 11 endpoints.

<Subscription xmlns="http://schemas.microsoft.com/2006/03/windows/events/subscription">
  <SubscriptionId>Security-Critical-Events</SubscriptionId>
  <SubscriptionType>SourceInitiated</SubscriptionType>
  <Description>Collects process execution and authentication telemetry from Windows 11 endpoints</Description>
  <Enabled>true</Enabled>
  <Uri>http://schemas.microsoft.com/wbem/wsman/1/windows/EventLog</Uri>
  <ConfigurationMode>MinLatency</ConfigurationMode>
  <Query>
    <![CDATA[
      <QueryList>
        <Query Id="0" Path="Security">
          <Select Path="Security">*[System[(EventID=4688 or EventID=4740)]]</Select>
        </Query>
      </QueryList>
    ]]>
  </Query>
  <ReadExistingEvents>false</ReadExistingEvents>
  <TransportName>http</TransportName>
  <ContentFormat>RenderedText</ContentFormat>
  <Locale Language="en-GB"/>
  <LogFile>ForwardedEvents</LogFile>
  <AllowedSourceDomainComputers>O:NSG:BAD:P(A;;GA;;;DC)S:</AllowedSourceDomainComputers>
</Subscription>

Key parameters within this definition include:

• ConfigurationMode: Set to MinLatency for near real-time security alerting (events delivered every 30 seconds), or Normal / MinBandwidth (events batched every 6 hours) to conserve network capacity.
• AllowedSourceDomainComputers: Employs Security Descriptor Definition Language (SDDL) syntax to restrict which client computer accounts are authorised to register and push telemetry to this subscription. The SDDL string above permits all members of Domain Computers (DC).
• ReadExistingEvents: When set to false, the collector ignores historical logs and collects only newly generated events post-subscription registration.

Managing and Auditing Subscriptions via wecutil Command-Line Syntax

With your XML configuration authored and saved (e.g. C:WEFSecurity-Critical-Events.xml), use wecutil to deploy, audit, and modify the subscription lifecycle.

Creating and Activating a Subscription

Execute the following command in an elevated prompt to parse and register the subscription:

wecutil cs C:WEFSecurity-Critical-Events.xml

Listing and Inspecting Registered Subscriptions

To view all active subscriptions currently hosted by the local collector service, run:

wecutil es

To inspect the detailed runtime parameters, delivery settings, and XML query of a specific subscription, invoke the get-subscription verb:

wecutil gs Security-Critical-Events

Querying Endpoint Runtime Connection Status

To diagnose whether client workstations are successfully establishing connections and streaming event packets, use the get-subscriptionruntimestatus verb:

wecutil grs Security-Critical-Events

This command outputs the total number of connected source machines, individual client NetBIOS/FQDN names, last contact timestamps, and any active error codes (such as authentication handshakes or XML parsing faults).

Modifying and Deleting Subscriptions

To update an existing subscription without removing client associations, edit the base XML document and apply changes using:

wecutil us C:WEFSecurity-Critical-Events.xml

To temporarily deactivate a subscription without purging its historical forwarded logs, execute:

wecutil ss Security-Critical-Events /e:false

To permanently delete a subscription from the Windows Event Collector registry store:

wecutil ds Security-Critical-Events

Troubleshooting Common WEF Authentication and Delivery Failures

When wecutil grs indicates that endpoints are failing to check in, review the following configuration points:

• Network Service ACL on Security Log: On Windows 11 client endpoints, the Security log is locked down. WinRM runs under the NETWORK SERVICE security context. You must ensure the NT AUTHORITYNETWORK SERVICE account has read permissions granted on the Security log channel via Group Policy or by adding the account to the local Event Log Readers security group.
• SPN Registration: Verify that the collector server possesses valid Service Principal Names registered in Active Directory (WSMAN/CollectorName and WSMAN/CollectorFQDN) using the setspn -L CollectorName command to ensure Kerberos ticket negotiation succeeds.
• Buffer Saturation: If high-volume logging fills the collector’s buffer, open Event Viewer, expand Windows Logs, right-click Forwarded Events, select Properties, and increase the Maximum log size (KB) allocation while enabling Overwrite events as needed.