Overview:

The Windows Event Collector service is responsible for managing continuous event subscriptions sourced from remote locations that support the Web Services-Management protocol. This includes event sources using the Intelligent Platform Management Interface (IPMI), hardware, and event logs. The Windows event log collector stores events that have been forwarded in a localized event log. If disabled or stopped, the service can no longer create event subscriptions, and forwarded events can’t be accepted.

Event collection enables administrators to retrieve events from a remote device and store the events in a fully centralized location. Events are stored on the collector computer’s local event logs. The event’s destination log path is a key subscription property. Event data is saved to the collector device’s event log, and any additional information related to event forwarding is added directly to the relevant event.

The Windows event log collector service requires manual startup, but it comes preinstalled. In the Windows Event Collector default configuration, it uses the Network Service account to log in. The Windows Event Collector service is reliant upon two system components a Windows event log and HTTP.

Common mistakes:

Please make sure the below points are taken care of:

• Please make sure that you have selected all types of windows logs including Informational logs also.

• Collector should be added in domain controller.

• Admin credential is provided.

Steps of configuration:

On the collector computer, type the following command on the command prompt:

>>  wecutil qc

Open

Now create a New Subscription

>>  On the collector computer in search box, run Event Viewer as an administrator.

Open

>>  Click Subscriptions in the console which is situated in the left side

>>  Start Windows Collector Service

If the Windows Event Collector service is not started, you will be prompted to confirm that you want to start it. This service must be started to create subscriptions and collect events. You must be a member of the Administrators group to start this service.

>>  On the actions menu, in right side click on the create subscription.

>>  In the Subscription Name box, type a name for the subscription

>>  In the Description box, enter an optional description.

>>  In the Destination Log, select the log file with help of dropdown where collected events are to be stored. Please make sure that the collected events are stored in the "System" log.

>>  now click on select computers from which events are to be collected

>> After adding a computer, you can test connectivity between it and the local computer by selecting the computer and clicking Test.

>> Now click on the add domain computer

>> In object name put your computer name one by one

>> Now click on select events

>> and click on all the events Critical, Warning, Verbose, Error, Information 

>>Drop Down Event level

>>Select Windows logs and click on check box as shown below.

>> After that drop down the events logs and in envent logs follow this path microsoft-windows-DriverFrameworks and click on the ok
 choose "Windows Log" in the dropdown.

1. Click on + next to Application & Services:

2. Click on + next to Microsoft

3. Click on + Next to Windows

4. Check the box next to "DriverFrameworks-UserMode"

>>Then click on the advance tab

>> Select "Specific User" and then click on user name and password

>> And put the username and password with the admin privilege

Click OK.

 >> Click OK on the Subscription Properties dialog box. The subscription will be added to the Subscriptions pane.

To check the status,

Right click on the Subscription name, select "runtime status". if the operation was successful, the Status of the subscription will be Active.

The following link provides additional information: https://msdn.microsoft.com/en-us/library/cc722010.aspx

Now, the collector setup is done, please

1.Forward logs from the other sources on this collector. Follow the steps in the article using the link below on source computers:

From Source Windows Server

2. Now, configure Nxlog on the collector, using the steps in the article using the link below:

Nxlog Configuration for Windows AD Logs

Note: If the AD machine is configured as the collector then you need to enable audit logs only on the AD machine. If the case is otherwise(any endpoint is configured as the collector), then you need to enable audit logs on each of the computers added in the subscriptions separately.

3. Steps to enable audit logs are given in the article from the link below:

https://seceon.atlassian.net/wiki/spaces/PP/pages/445612089

Ref link: https://andys-tech.blog/2021/07/windows-event-collector-tutorial/