{"id":4203,"date":"2019-09-06T17:15:13","date_gmt":"2019-09-06T14:15:13","guid":{"rendered":"https:\/\/www.systemcodegeeks.com\/?p=4203"},"modified":"2019-09-06T12:33:50","modified_gmt":"2019-09-06T09:33:50","slug":"remote-log-collection-on-windows","status":"publish","type":"post","link":"https:\/\/www.systemcodegeeks.com\/windows\/remote-log-collection-on-windows\/","title":{"rendered":"Remote Log Collection on Windows"},"content":{"rendered":"\n

Every organization needs to collect logs from multiple sources in order to put them in either a log collector or SIEM (or a dedicated audit trail solution<\/a>). And there are two options for that \u2013 using an agent and agentless.<\/p>\n\n\n\n

Using an agent is easy \u2013 you install a piece of software on each machine that generates logs and it forwards them wherever needed. This is however not preferred by many organizations as it complicates things \u2013 upgrading to new versions, keeping track of dozens of configurations, and potentially impacting performance of the target machines.<\/p>\n\n\n\n

So some organizations prefer to collect logs remotely, or use standard tooling, already present on the target machine. For Linux that\u2019s typically syslog, where forwarding is configured. Logs can also be read remotely via SCP\/SSH.<\/p>\n\n\n\n

However, on Windows things are less straightforward. You need to access the Windows Event Log facility remotely, but there is barely a single place that describes all the required steps. This blogpost comes close<\/a>, but I\u2019d like to provide the full steps, as there are many, many things that one may miss. It is a best practice to use a non-admin, service account for that and you have to give multiple permissions to allow reading the event logs remotely.<\/p>\n\n\n\n

There are also multiple ways to read the logs remotely:<\/p>\n\n\n\n