Auth & Permissions

Windows Event Forwarding (WEF) relies on secure authentication and granular authorization to ensure only trusted systems and users can forward and consume events. This section covers configuring Kerberos/NTLM authentication and role-based access control (RBAC) to secure event forwarding in a Windows environment.

Kerberos Authentication Configuration¶

Prerequisites¶

Domain environment: Kerberos requires Active Directory Domain Services (AD DS).
SPN registration: The Event Forwarding service must have a Service Principal Name (SPN) registered.
Time synchronization: Ensure all domain controllers and servers are synchronized with a reliable time source.

Steps¶

Register SPN for Event Forwarding
Use setspn to register an SPN for the Event Forwarding service. Replace EventForwarder01 with the server name:
```
setspn -S HTTP/EventForwarder01 EventForwarder01
```
Verify the SPN is registered:
```
setspn -L EventForwarder01
```
Configure Kerberos on the Source Server
Ensure the source server is joined to the domain and the Event Log service is configured to use Kerberos. This is typically handled automatically if the server is part of a domain, but verify via:
```
Get-WmiObject -Class Win32_Service -Filter "Name='EventLog'"
```
Enable Kerberos for Event Forwarding
On the destination server, ensure the Event Log Forwarding service is configured to accept Kerberos authentication. This is done via the Event Log Management console or PowerShell:
```
Set-EventLogForwardingServer -ComputerName "DestinationServer" -Authentication Kerberos
```

NTLM Authentication Configuration¶

When to Use NTLM¶

NTLM is suitable for non-domain environments or when Kerberos is not feasible (e.g., legacy systems). However, it is less secure than Kerberos and should be used only when necessary.

Steps¶

Enable NTLM on the Source Server
Configure the source server to use NTLM by editing the registry:

Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\EventLog" -Name "Authentication" -Value 2

Restart the Event Log service:

Restart-Service EventLog

Configure Destination Server
On the destination server, ensure the Event Log service is set to accept NTLM:
```
Set-EventLogForwardingServer -ComputerName "DestinationServer" -Authentication NTLM
```

Role-Based Access Control (RBAC)¶

Assigning Permissions¶

WEF uses the Event Log Readers group to control access. Customize roles using the Event Log Management console or PowerShell:

Create a Custom Role
Use the Event Log Management console to define a new role, assigning permissions like "Read Events" or "Write Events" to specific users or groups.

Assign Roles via PowerShell
Add users to the Event Log Readers group:

Add-ADGroupMember -Identity "Event Log Readers" -Members "User01"

Verify group membership:

Get-ADGroupMember -Identity "Event Log Readers"

Restrict Access to Forwarded Events
On the destination server, configure the Event Log service to limit access to specific users or groups via the Event Log Properties dialog in the Event Viewer.

Security Best Practices¶

Enable Encryption: Use HTTPS or SMB for secure event transport.

Set-EventLogForwardingServer -ComputerName "DestinationServer" -Encryption Enabled

Audit Access: Monitor the Security log for failed authentication attempts (Event ID 4625).
Regularly Review Permissions: Ensure only authorized users and services have access to event data.

Key Takeaways¶

Kerberos is preferred for secure, domain-based event forwarding, requiring SPN registration and domain membership.
NTLM is a fallback option for non-domain environments but lacks Kerberos' security features.
RBAC via the Event Log Readers group and custom roles ensures granular control over event access.
Encryption and auditing are critical to protect forwarded events from interception or unauthorized access.
Always validate SPN configurations and test authentication settings in a non-production environment before deployment.