Windows Event Forwarding Troubleshooting Guide

!Issue

Troubleshoot Windows Event Forwarding subscriptions by checking WinRM, collector configuration, firewall rules and source connectivity.

✓Solution

01 Check the collector

★Recommendations

06 Validate delivery Generate a controlled test event and confirm it arrives at the collector.

Confirm the Windows Event Collector service is running and the subscription is active.

Check the collector

Validate WinRM on the source computers and confirm the listener and service are available.

Confirm the required WinRM traffic is permitted between source computers and the collector.

Use wecutil es and wecutil gs to review subscriptions and identify source or configuration errors.

Check Microsoft-Windows-EventCollector and Microsoft-Windows-WinRM logs for authentication or transport errors.

Generate a controlled test event and confirm it arrives at the collector.

Continue with practical infrastructure troubleshooting, PowerShell scripts and operational runbooks.