Problems with logs being forwarded to the WEC (Windows Event Collector) server.

Question

Problems with logs being forwarded to the WEC (Windows Event Collector) server.

Marcel Silva 0

Hello,

I have a WEC (Windows Event Collector) server that collects security logs from several servers in my environment. However, two of these servers are forwarding some logs to the WEC server with masked fields using a % followed by a number. For example:

yamlCopiarEditarMSWinEventLog 1 Security 5666309 Wed Jul 02 10:50:44 2025 4740 Microsoft-Windows-Security-Auditing N/A N/A Success Audit CONTOSO.com User Account Management  A user account was locked out.    
Subject:   
  Security ID:  CONTOSO$   
  Account Name:  CONTOSO   
  Account Domain:  0x3e7   
  Logon ID:  %7    
Account That Was Locked Out:   
  Security ID:  %3   
  Account Name:  %1    
Additional Information:   
  Caller Computer Name: %2 
-1015733198

This usually happens with event ID 4740, and not with all events — only some of them. Because of this, it's difficult to identify the user who performed the action.

Is there any way to correct these logs? Is this kind of situation expected?

All logs are being forwarded via subscription. If anyone can help, I’d really appreciate it.

Details: WEC Server OS: Windows Server 2019 Standard - Version 1809

0 comentários

1 resposta

Sua resposta

Answer 1

Welcome to the Microsoft Q&A Platform!

Thank you for submitting your question.

Based on your description, I would like to offer some guidance to help address the issue you're encountering.

To preserve all the details of the original event, including full user and computer information, I recommend switching to raw XML forwarding. This way, you can parse the XML fields directly (e.g., using PowerShell, Log Analytics, or SIEM tools) to extract user actions.

When event logs are forwarded using subscription filters in XML (especially in the RenderedText format), some event fields may appear masked with placeholders such as %1, %2, etc., instead of showing the actual values (e.g., account names or computer names). These placeholders refer to event template values and are typically used when the event collector cannot properly resolve the event message locally.

To change the subscription format Follow these steps to modify your WEC subscription to collect raw XML (unrendered events) instead of the rendered text format:

Open Event Viewer on the WEC server.
Navigate to Subscriptions.
Right-click your subscription and select Properties.
Click Advanced.
Change the setting to "Events" (instead of "Rendered Text").
Save the changes and restart the Windows Event Collector service.

This will allow you to receive the full event XML, including correct values for fields such as Account Name, Security ID, and more.

This behavior is expected under certain conditions. It's common when the WEC server cannot properly interpret security log templates or when rendered events are forwarded without the necessary translation support.

I hope this information helps you resolve your issue. Wishing you a pleasant day ahead!