thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Security Operations · Advanced

Windows Event Forwarding (WEF)

A built-in Windows feature that forwards event logs from many hosts to a central Windows Event Collector.

Definition

WEF uses WinRM and subscriptions defined on a collector server, either source-initiated (via Group Policy) or collector-initiated. It allows centralized log collection without third-party agents, often feeding a SIEM. Subscriptions filter which events are forwarded.

Example

A GPO configuring all workstations to forward 4624, 4688 and Sysmon events to a collector.

Exam tip

WEF is the agentless native option for centralizing Windows logs.

Related terms