Windows has an amazing feature that let's you collect logs from remote computers, it's called Windows Event forwarding and is pretty easy to set up. Once we have this data we can use free tools such as Splunk or GrayLog to analyse the data, find patterns, fix.

Below is the way to get started collecting the user profile logs to analyse things such as login performance with roaming profiles, something we are dealing with right now! Please note you need to enable winrm on your computers for forwarding to work.

First you need a machine that will be the data collectior.

1. On that machine open Event Viewer and right click Subscriptions. You may get the following message to enable the service on startup

2. Now you should only collect data that you will use, in this example we are collecting the Microsoft-Windows-User Profile Service/Operational events so we will call it Microsoft-Windows-User Profile Service - Operational

3. Change the type to Source computer initiated and click Select Computer Groups

4. Add the group of machines to the Computer list and click OK

5. Click Select Events

6. We now select the Applications and Services Logs\Microsoft\Windows\User Profile Service

7. You can configure advanced settings to control how the computers forward the events.

8. Click OK

9. To get clean data we need to change the format of returned events by running the command:
wecutil ss "Microsoft-Windows-User Profile Service - Operational" /cf:Events

10. Next you deploy a group policy that tells your computers to go to the data collector for jobs

Create a group policy using Computer Configuration\Policies\Administrative Templates\Windows Components\Event Forwarding

11. Select Configure target Subscription Manager

12. Set to Enabled

13. Click Show

14. Insert the line
Server=http://SERVER.FQDN:5985/wsman/SubscriptionManager/WEC,Refresh=60

15. Replace SERVER.FQDN with your data collector's name.

16. To test run GPUPDATE /FORCE on the remote machine

17. If successful, on the data machine you will see the number of source computers change and logs in the forwarded events

Visit https://blogs.technet.microsoft.com/jepayne/2015/11/23/monitoring-what-matters-windows-event-forwarding-for-everyone-even-if-you-already-have-a-siem/ for more information.

PART 2