Listen to this Post
Introduction:
In the chaotic landscape of cybersecurity incidents, the integrity and immediate availability of log data are paramount for effective digital forensics and incident response (DFIR). Centralizing Windows event logs using native, built-in tools provides a robust, cost-effective alternative to complex, agent-based solutions. This article explores the deep configurability and security advantages of the Windows Event Collector (WEC), a free and powerful feature within your existing Microsoft on-premise environment.
Learning Objectives:
- Understand the architecture and security benefits of a Source-Initiated (Push) WEC subscription.
- Learn how to deploy and harden a WEC infrastructure to meet stringent security guidelines like those from ANSSI.
- Master the commands and configurations to collect raw event logs efficiently, accelerating investigation timelines.
You Should Know:
1. Understanding the WEC Architecture: Collector vs. Source
The Windows Event Collector operates on a simple yet powerful publisher-subscriber model. The WEC server is the central collector that subscribes to specific events. The source computers (clients) are configured to forward these events upon generation. The critical design choice lies in the initiation mode: Source-Initiated (Push) is highly recommended over Collector-Initiated (Pull). In Push mode, the source computers initiate the connection to the collector. This means the collector does not need to expose a listening port like WinRM to the entire network, drastically reducing its attack surface. Source computers only need outbound HTTPS (5986) access to the collector.
2. Deploying the WEC Server: A Step-by-Step Guide
The WEC server is the central hub. Its setup is straightforward but requires specific configuration for security and performance.
Step 1: Install the Role Service. On your designated Windows Server, launch Server Manager, and add the “Windows Event Collector” feature under the “Event Forwarding” role service.
Step 2: Configure the Service. Open an elevated command prompt and run `wecutil qc /q` to quickly configure the Windows Event Collector service. This command sets the service to start automatically and creates the necessary HTTP listener.
Step 3: Harden the Server. Apply strict firewall rules. Only allow inbound traffic on port 5986 (HTTPS) from your domain-joined source computers. The collector should not be directly accessible from the internet.
3. Configuring Source-Initiated Subscriptions for Maximum Security
This is the core of the secure architecture. Instead of the collector “pulling” from each source, we configure the sources to “push” their logs to a specific collector.
Step 1: Create a Group Policy Object (GPO). This is the most scalable method for an enterprise. Create a new GPO in the Group Policy Management Console.
Step 2: Configure Computer Policy. Navigate to Computer Configuration > Policies > Administrative Templates > Windows Components > Event Forwarding.
Step 3: Configure Target Subscription. Enable the “Configure target subscription manager” policy. In the options, add the FQDN of your WEC server in the format: `Server=http://WEC-Server.domain.local:5985/wsman/SubscriptionManager/WEC,Refresh=10`. While the post recommends avoiding WinRM exposure, the initial GPO configuration often uses HTTP (5985) for discovery. The actual log transfer can be secured with HTTPS. The `Refresh` value (in minutes) dictates how often sources check for subscription updates.
Step 4: Link the GPO. Link this GPO to the Organizational Unit (OU) containing the computers you wish to monitor.
4. Creating the Subscription on the WEC Server
Now, define what events you want to collect.
Step 1: Open Event Viewer. On the WEC server, open Event Viewer. Right-click on “Subscriptions” and select “Create Subscription.”
Step 2: Choose Subscription Type. Select “Source-Initiated”. This is the key security choice.
Step 3: Select Source Computers. Click “Add Domain Computers” or, more securely, “Add Domain Groups” and select the AD group containing your source computers. This group should be the one targeted by your GPO.
Step 4: Define Events. Click “Select Events” to open the Query Filter. Here, you can build sophisticated queries. For critical security monitoring, a good starting point is to collect all logs from the “Security” and “System” logs. A more advanced query for process creation (Event ID 4688) with command-line auditing would be invaluable for threat hunting.
5. Hardening the Communication: From HTTP to HTTPS
While functional, the default configuration often uses plaintext HTTP. To meet ANSSI-level integrity and confidentiality requirements, you must secure the channel with HTTPS.
Step 1: Create a Certificate. Deploy an internal PKI. Issue a server authentication certificate to the WEC server from a trusted internal Certificate Authority (CA).
Step 2: Configure WinRM Listener. On the WEC server, delete the existing HTTP listener and create a new HTTPS listener. Run the following in an elevated PowerShell window:
Remove the default HTTP listener Remove-Item -Path WSMan:\Localhost\listener\listener -Recurse Create a new HTTPS listener, binding it to the server's certificate New-Item -Path WSMan:\Localhost\listener -Transport HTTPS -Address -CertificateThumbprint "Your_Certificate_Thumbprint"
Step 3: Update GPO. Modify the GPO created earlier to use the HTTPS port (5986) in the subscription manager address: `Server=https://WEC-Server.domain.local:5986/wsman/SubscriptionManager/WEC,Refresh=10`.
6. Verification and Operational Commands
After deployment, verify that the system is working correctly.
On the WEC Server:
Check the subscription runtime status: `wecutil gr SubscriptionName`
Test connectivity to a source: `winrs -r:http://ClientPC.domain.local:5985 dir`
On a Source Client:
Check if the client has registered the subscription: `wecutil es`
Force an immediate policy update and subscription refresh: `gpupdate /force && wecutil rs SubscriptionName`
7. Forensic Value and Integration
The primary forensic value of WEC is the collection of raw event logs. Unlike many SIEM agents that parse and normalize data, potentially losing metadata or context, WEC forwards the original `.evtx` files. This ensures evidence integrity, which is crucial for legal proceedings. These centralized logs can then be ingested by a SIEM for correlation and alerting, or archived in a secure, immutable storage for long-term retention as required by compliance frameworks.
What Undercode Say:
- Cost-Effective Fortification: WEC is a classic example of “using what you already own.” It eliminates per-endpoint licensing costs for third-party log collectors, allowing security budgets to be allocated to other critical areas.
- Reduced Attack Surface is Paramount: The Source-Initiated design philosophy is a core security win. By ensuring critical servers (the collectors) are not passively listening for connections, you close a common attack vector used in lateral movement.
The push for cloud-native security services often overshadows the powerful, deeply integrated capabilities of on-premise systems. WEC represents a mature, stable, and highly configurable technology that aligns perfectly with a defense-in-depth strategy. Its ability to provide raw, unaltered logs is a forensic investigator’s dream, preserving the chain of evidence. As the original post astutely warns, organizations should master and leverage these native tools “while they are still available,” as the industry’s focus shifts, potentially leaving behind this level of deep, license-free control.
Prediction:
The underlying principles of WEC—agentless data collection, reduced attack surface, and raw log preservation—will be increasingly adopted and abstracted by cloud providers and next-generation EDR/XDR platforms. We predict a future where the “WEC model” becomes the standard for secure telemetry collection within cloud IaaS and containerized environments, moving beyond just Windows to become a universal standard for secure, source-initiated data streaming. However, the deep, granular control offered by the on-premise WEC will remain a valuable skill for IR teams dealing with hybrid environments for the next decade.
🎯Let’s Practice For Free:
IT/Security Reporter URL:
Reported By: Arnaud Pilon – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
