Skip to contentGo to the directory tree
Windows Directory Tree
  1. C:
  2. Windows
  3. System32
  4. winevt
  5. Logs
  6. ForwardedEvents.evtx
LogRisk: Caution

ForwardedEvents.evtx C:\Windows\System32\winevt\Logs\ForwardedEvents.evtx

Forwarded Events log: default destination for events collected from other computers by a Windows Event Collector subscription.

Updated on By AltF4 Formation

What it’s for

ForwardedEvents.evtx is the “Forwarded Events” log. Events collected from other computers by Windows Event Collector subscriptions (managed with wecutil) land here by default. On a machine that is not a collector, it stays empty.

What it contains

  • Events from source computers (Security, System, Application, etc.), with their original computer name.
  • Content depends entirely on the defined subscriptions (filters, sources).
  • A subscription can target a different log than this one, depending on its configuration.

Risks and best practices

  • The log can concentrate security events from a whole fleet: restrict access to the collector and protect the file.
  • Set the maximum log size deliberately, otherwise old events are overwritten too quickly.
  • Clear or export the log with wevtutil rather than deleting the file. Subscriptions are managed with wecutil, not in the file.
  • A poorly filtered subscription generates a large volume, so test with a few sources first.

Useful commands

Fenêtre de terminal
# Latest 20 forwarded events
Get-WinEvent -LogName ForwardedEvents -MaxEvents 20 | Select-Object TimeCreated, MachineName, Id, LogName, Message


# Enumerate the collector's subscriptions
wecutil es


# Show a subscription's details
wecutil gs "<subscription name>"


# Check the Windows Event Collector service
Get-Service Wecsvc


# See the log size and retention
wevtutil gl ForwardedEvents

Format

Binary XML file (.evtx). Each forwarded event keeps its original data and identifies the source computer.

Rotation and archiving

Maximum size and retention are configurable with wevtutil sl ForwardedEvents or in Event Viewer; wevtutil gl ForwardedEvents shows the values. Export with wevtutil epl to archive.

How to read it

Event Viewer > Windows Logs > Forwarded Events. In PowerShell: Get-WinEvent -LogName ForwardedEvents, and filter on MachineName to isolate a source. For a copied file: Get-WinEvent -Path .\ForwardedEvents.evtx.

Report a mistake