Windows Event Fowarder

This lays out how to create a sbuscription (both source and collector initiated) that collects selected forwarded .evtx event logs from a workstation to a domain controller.

SUMMARY

This shows the process of how to create custom .evtx log files using ecmangen.exe and other utilities present in the Windows Development Kit. The log file(s) created could be used as a destination log for forwarded events.

ENVIRONMENT:

MACHINES:

HOSTNAME

MACHINE IP

OS

REMARKS

MSEDGEWIN10

192.168.150.128

Windows 10 Enterprise Evaluation

Source Machine

WIN-BO2CT95INDP

192.168.150.133

Windows Server 2016

Collector Machine

  • The FQDN for WIN-BO2CT95INDP is win-bo2ct95indp.bossmanben.local

ASSUMPTIONS:

1. The Source Machine (MSEDGEWIN10) is part of a Domain Controller (WIN-BO2CT95INDP).

2. This guide uses Security Logs as an example.

3. The steps below will create a subscription that collects Security logs from the Source Machine (MSEDGEWIN10).

PROCEDURE:

1. Start the WinRM service

  1. Open PowerShell on the Source Machine (MSEDGEWIN10):

    winrm quickconfig

    Add the Collector Machine to the Source Machine's trustedhosts:

    Set-Item wsman:localhost/client/trustedhosts 192.168.150.133

    Restart the service for changes to take effect:

    Restart-Service WinRM

  2. Check if the service is running:

    winrm get winrm/config

    AllowRemoteAccess = true signifies that the service is running.

    ...omitted...
        AllowRemoteAccess = true
    Winrs
        AllowRemoteShellAccess = true
...omitted...

  3. Test if the Collector Machine (BOSSMANBEN) is reachable using WinRM:

    Test-WSMan WIN-BO2CT95INDP
    wsmid           : http://schemas.dmtf.org/wbem/wsman/identity/1/wsmanidentity.xsd
ProtocolVersion : http://schemas.dmtf.org/wbem/wsman/1/wsman.xsd
ProductVendor   : Microsoft Corporation
ProductVersion  : OS: 0.0.0 SP: 0.0 Stack: 3.0

    WinRM is enabled by default on Windows Server 2012 and up. This is just a measure to check if the Collector Machine is indeed reachable.

ii. Add the Collector Machine to the Event Log Readers groups

In the Source Machine (MSEDGEWIN10):

  1. Open the Local Users and Groups:

    • Press Win + R then enter lusrmgr.msc

  2. Navigate to Local Users and Groups (Local) > Groups:

    1. Right-click Event Log Readers and select Properties

    2. Select Add...

  3. Select Object Types... then check the box, Computers

  4. Enter the object names to select -- "WIN-BO2CT95INDP"

    • Select Check Names for good measure.

  5. Select OK when done.

iii. Create Subscriptions using Event Viewer

In the Collector Machine (WIN-BO2CT95INDP):

Open the Event Viewer -- Press Win + R then enter gpedit eventvwr.msc and on the left panel, right-click on Subscriptions then select Create Subscription...

  1. Subscription Name -- Remote Security Logs

  2. Description -- Security Logs from the Domain Computer, MSEDGEWIN10

  3. Destination log -- Forwarded Events

    • Custom logs could be created but Forwarded Events is selected by default.

    • Click here to create custom logs.

  4. Select Subscription type and source computers:

    If you choose Collector initiated, then select Select Computers...

    1. Select Add Domain Computers...

    2. Enter the object name to select -- "MSEDGEWIN10"

    3. Select Check Names for good measure.

    4. Select OK

    5. Select Test for good measure.

    6. Select OK

    For Source initiated, select Select Computer Groups... then do the following extra steps on the Source Machine

    1. Press Win + R then enter gpedit.msc

      1. Navigate to Computer Management > Administrative Templates > Windows Components > Event Forwarding

      2. Right-click on Configure target Subscription Manager then select Edit

      3. Choose Enabled

      4. Under Options, beside SubscriptionManagers, press Show...

      5. Enter Server= http://win-bo2ct95indp.bossmanben.local:5985 /wsman/SubscriptionManager/WEC, Refresh=30

      6. Press OK

      7. Press OK

    2. Open PowerShell or cmd the run gpupdate /force

    For Source initiated, do the following on the Collector Machine (WIN-BO2CT95INDP)

    1. Open PowerShell or cmd then run wecutil quick-config

  5. Select Select Events...:

    1. Logged -- "Any time"

    2. Event level -- Critical, Error, Information, Warning

    3. Choose By log -- Windows -> Security

    4. Filter Event IDs -- 4624, 4657, 4688, 4698, 4720, 4722, 4724, 4732, 4738, 4769

    5. Select OK

  6. Select Advanced...:

    1. User Account -- Choose Machine Account

    2. Event Delivery Optimization -- Choose Minimize Latency

    3. Select OK

    OPTION

    DESCRIPTION

    INTERVAL

    Normal

    Does not conserve bandwidth

    15 minutes via pull delivery

    Minimize Bandwidth

    Bandwidth for delivery is controlled

    6 hours via push delivery

    Minimize Latency

    Delivery with minimal delay

    30 seconds via push delivery

  7. Select OK

  8. Right-click on the newly created subscription then select Runtime Status:

    [MSEDGEWIN10.bossmanben.local] - Error - Last retry time: 7/17/2019 8:27:52 PM. 
Code (0x138C): <f:ProviderFault provider="Event Forwarding Plugin" path="C:\Windows\system32\wevtfwd.dll"

In the Source Machine (WIN-BO2CT95INDP)

  1. Run wevtutil:

    wevtutil get-log Security
    name: Security
enabled: true
type: Admin
owningPublisher:
isolation: Custom
channelAccess: O:BAG:SYD:(A;;0xf0005;;;SY)(A;;0x5;;;BA)(A;;0x1;;;S-1-5-32-573)
logging:
  logFileName: %SystemRoot%\System32\Winevt\Logs\Security.evtx
  retention: false
  autoBackup: false
  maxSize: 20971520
publishing:
  fileMax: 1

  2. Add the Network Service Account (S-1-5-20) to the channelAccess field:

    wevtutil set-log Security /ca:"O:BAG:SYD:(A;;0xf0005;;;SY)(A;;0x5;;;BA)(A;;0x1;;;S-1-5-32-573)(A;;0x1;;;S-1-5-20)"

    • WinRM runs under the Network Service Account which had no access to the Security Logs

Going back to the Collector Machine (WIN-BO2CT95INDP)

  1. Go to the Event Viewer:

    • Press Win + R then enter gpedit eventvwr.msc

  2. On the left panel, go to Subscriptions then select the recently created subscription

  3. On the right panel, under the subscription name, select Retry

  4. Right-click on the recently created subscription then select Runtime Status:

    [MSEDGEWIN10.bossmanben.local] - Active - : No additional status.

    • An Event with ID 100 (Name="SubscribeSuccess") will appear on Microsoft-Windows-Event-ForwardPlugin/Operational in the Source Machine (MSEDGEWIN10)

Finally, Wait for logs to be sent to the Forwarded Events logs

NOTE(S):

  • TImestamps are preserved

  • Log contents are preserved

REFERENCES:

- https://www.vkernel.ro/blog/how-to-configure-windows-event-log-forwarding?fbclid=IwAR1bQ9VpgL--PWaqvEWcJBduR3xJ2UnBBhZmO7UGef-NXcKN9PCINZ3gmQ0
- https://www.itprotoday.com/strategy/q-what-are-some-simple-tips-testing-and-troubleshooting-windows-event-forwarding-and?fbclid=IwAR3ceGoJU-jgkD2U_rVo2FmQee5M0spvE85lZRVw0FHv4YFTphLaX-5JJe8
- https://rockyprogress.wordpress.com/2011/12/04/security-event-log-collection-from-a-domain-controller/?fbclid=IwAR01Puy9Wvr4eCQeV828raqfLesYJwVTw_8EAmDgvJIKYBVWoaT3giv24PA
- https://blogs.technet.microsoft.com/supportingwindows/2016/07/18/setting-up-a-source-initiated-subscription-on-an-event-collector-computer/?fbclid=IwAR2JagIePrComWaIcZknK_92Igakb4_jvnrmJJnGpZlFGnms_2PM7z6trJc
Previouselastalert.pyNextCustom EVTX Logs

Last updated