WinRM log forwarding in Windows 2012 R2 Server

Question

I have various servers in Active Directory with different Roles like SCCM server, Database Server, MS Lync, MS Exchange 2013 and MS SharePoint Server.

For their Security logs auditing, we have RSA Netwitness Platform.

In them some of the services are configured via the WinRM method for taking logs from event viewers like Application, Security, System.

But still we are not able to monitoring different Roles which is described in above me by WinRM

wevtutil sl Application /ca:existing-SDDL-string(A;;0x1;;;S-1-5-20)

wevtutil sl Security /ca:existing-SDDL-string(A;;0x1;;;S-1-5-20)

wevtutil sl System /ca:existing-SDDL-string(A;;0x1;;;S-1-5-20)

Please suggest any practice, so I am able to monitor SCCM, SQL, MS Lync, MS Exchange 2016 and MS Sharepoint Server 2016 all logs by WinRM

Answer 1

Hi @Parichay Saxena ,

Welcome to the Microsoft Q&A platform!

Based on your description, to effectively monitor the logs of different roles such as SCCM, SQL, MS Lync, MS Exchange 2016, and MS SharePoint Server 2016 using WinRM, you can follow some of the best practices and steps below:

1. Verify that WinRM is properly configured and enabled on all servers. You can use the command winrm quickconfig to set the default configuration.
2. Make sure the necessary firewall ports (TCP 5985 for HTTP and TCP 5986 for HTTPS) are open to allow incoming connections.
3. The user account used for WinRM authentication must have the required permissions to access the logs. For example, to access the security log, the user account needs to be a member of the local administrators group or have the "Manage auditing and security log" user right.
4. Use the wevtutil command to configure the security descriptor for each log you want to access. For example:

wevtutil sl Application /ca:existing-SDDL-string(A;;0x1;;;S-1-5-20)
wevtutil sl Security /ca:existing-SDDL-string(A;;0x1;;;S-1-5-20)
wevtutil sl System /ca:existing-SDDL-string(A;;0x1;;;S-1-5-20)

This will grant the local Network Service account read access to the log.

5. After you configure the security descriptor, you can use the wevtutil command to retrieve log data. For example:

wevtutil qe Security /rd:true /f:text /q:"* [System [Provider [@Name='Microsoft-Windows-Security-Auditing']]]"

This command retrieves all events from the security log generated by the Microsoft-Windows-Security-Auditing provider.

6. For enhanced security, configure WinRM to use HTTPS instead of HTTP. This ensures that data transmitted over the network is encrypted.
7. Enable PowerShell logging to capture detailed information about activities performed through WinRM.

By following these steps, you should be able to effectively monitor logs for SCCM, SQL, MS Lync, MS Exchange 2016, and MS SharePoint Server 2016 using WinRM.

---

Please feel free to contact me for any updates. And if this helps, don't forget to mark it as an answer.

Best,

Jake Zhang