[{"data":1,"prerenderedAt":122},["ShallowReactive",2],{"i-heroicons:building-office-2":3,"i-heroicons:computer-desktop":8,"i-heroicons:cloud":10,"i-heroicons:server":12,"i-heroicons:folder":14,"i-heroicons:chart-bar":16,"i-heroicons:lock-closed":18,"i-heroicons:rectangle-stack":20,"i-heroicons:scale":22,"i-heroicons:key":24,"i-heroicons:finger-print":26,"i-heroicons:cpu-chip":28,"i-heroicons:document-text":30,"i-heroicons:shield-exclamation":32,"i-heroicons:shield-check":34,"blog-en-aggregate-yubion-windows-event-logs-another-pc":36,"i-heroicons:user":120},{"left":4,"top":4,"width":5,"height":5,"rotate":4,"vFlip":6,"hFlip":6,"body":7},0,24,false,"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"1.5\" d=\"M2.25 21h19.5m-18-18v18m10.5-18v18m6-13.5V21M6.75 6.75h.75m-.75 3h.75m-.75 3h.75m3-6h.75m-.75 3h.75m-.75 3h.75M6.75 21v-3.375c0-.621.504-1.125 1.125-1.125h2.25c.621 0 1.125.504 1.125 1.125V21M3 3h12m-.75 4.5H21m-3.75 3.75h.008v.008h-.008zm0 3h.008v.008h-.008zm0 3h.008v.008h-.008z\"\u002F>",{"left":4,"top":4,"width":5,"height":5,"rotate":4,"vFlip":6,"hFlip":6,"body":9},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"1.5\" d=\"M9 17.25v1.007a3 3 0 0 1-.879 2.122L7.5 21h9l-.621-.621A3 3 0 0 1 15 18.257V17.25m6-12V15a2.25 2.25 0 0 1-2.25 2.25H5.25A2.25 2.25 0 0 1 3 15V5.25m18 0A2.25 2.25 0 0 0 18.75 3H5.25A2.25 2.25 0 0 0 3 5.25m18 0V12a2.25 2.25 0 0 1-2.25 2.25H5.25A2.25 2.25 0 0 1 3 12V5.25\"\u002F>",{"left":4,"top":4,"width":5,"height":5,"rotate":4,"vFlip":6,"hFlip":6,"body":11},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"1.5\" d=\"M2.25 15a4.5 4.5 0 0 0 4.5 4.5H18a3.75 3.75 0 0 0 1.332-7.257a3 3 0 0 0-3.758-3.848a5.25 5.25 0 0 0-10.233 2.33A4.5 4.5 0 0 0 2.25 15\"\u002F>",{"left":4,"top":4,"width":5,"height":5,"rotate":4,"vFlip":6,"hFlip":6,"body":13},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"1.5\" d=\"M21.75 17.25v-.228a4.5 4.5 0 0 0-.12-1.03l-2.268-9.64a3.375 3.375 0 0 0-3.285-2.602H7.923a3.375 3.375 0 0 0-3.285 2.602l-2.268 9.64a4.5 4.5 0 0 0-.12 1.03v.228m19.5 0a3 3 0 0 1-3 3H5.25a3 3 0 0 1-3-3m19.5 0a3 3 0 0 0-3-3H5.25a3 3 0 0 0-3 3m16.5 0h.008v.008h-.008zm-3 0h.008v.008h-.008z\"\u002F>",{"left":4,"top":4,"width":5,"height":5,"rotate":4,"vFlip":6,"hFlip":6,"body":15},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"1.5\" d=\"M2.25 12.75V12A2.25 2.25 0 0 1 4.5 9.75h15A2.25 2.25 0 0 1 21.75 12v.75m-8.69-6.44l-2.12-2.12a1.5 1.5 0 0 0-1.061-.44H4.5A2.25 2.25 0 0 0 2.25 6v12a2.25 2.25 0 0 0 2.25 2.25h15A2.25 2.25 0 0 0 21.75 18V9a2.25 2.25 0 0 0-2.25-2.25h-5.379a1.5 1.5 0 0 1-1.06-.44\"\u002F>",{"left":4,"top":4,"width":5,"height":5,"rotate":4,"vFlip":6,"hFlip":6,"body":17},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"1.5\" d=\"M3 13.125C3 12.504 3.504 12 4.125 12h2.25c.621 0 1.125.504 1.125 1.125v6.75C7.5 20.496 6.996 21 6.375 21h-2.25A1.125 1.125 0 0 1 3 19.875zm6.75-4.5c0-.621.504-1.125 1.125-1.125h2.25c.621 0 1.125.504 1.125 1.125v11.25c0 .621-.504 1.125-1.125 1.125h-2.25a1.125 1.125 0 0 1-1.125-1.125zm6.75-4.5c0-.621.504-1.125 1.125-1.125h2.25C20.496 3 21 3.504 21 4.125v15.75c0 .621-.504 1.125-1.125 1.125h-2.25a1.125 1.125 0 0 1-1.125-1.125z\"\u002F>",{"left":4,"top":4,"width":5,"height":5,"rotate":4,"vFlip":6,"hFlip":6,"body":19},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"1.5\" d=\"M16.5 10.5V6.75a4.5 4.5 0 1 0-9 0v3.75m-.75 11.25h10.5a2.25 2.25 0 0 0 2.25-2.25v-6.75a2.25 2.25 0 0 0-2.25-2.25H6.75a2.25 2.25 0 0 0-2.25 2.25v6.75a2.25 2.25 0 0 0 2.25 2.25\"\u002F>",{"left":4,"top":4,"width":5,"height":5,"rotate":4,"vFlip":6,"hFlip":6,"body":21},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"1.5\" d=\"M6 6.878V6a2.25 2.25 0 0 1 2.25-2.25h7.5A2.25 2.25 0 0 1 18 6v.878m-12 0q.354-.126.75-.128h10.5q.396.002.75.128m-12 0A2.25 2.25 0 0 0 4.5 9v.878m13.5-3A2.25 2.25 0 0 1 19.5 9v.878m0 0a2.3 2.3 0 0 0-.75-.128H5.25q-.396.002-.75.128m15 0A2.25 2.25 0 0 1 21 12v6a2.25 2.25 0 0 1-2.25 2.25H5.25A2.25 2.25 0 0 1 3 18v-6c0-.98.626-1.813 1.5-2.122\"\u002F>",{"left":4,"top":4,"width":5,"height":5,"rotate":4,"vFlip":6,"hFlip":6,"body":23},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"1.5\" d=\"M12 3v17.25m0 0c-1.472 0-2.882.265-4.185.75M12 20.25c1.472 0 2.882.265 4.185.75M18.75 4.97A48 48 0 0 0 12 4.5c-2.291 0-4.545.16-6.75.47m13.5 0q1.515.215 3 .52m-3-.52l2.62 10.726c.122.499-.106 1.028-.589 1.202a6 6 0 0 1-2.031.352a6 6 0 0 1-2.031-.352c-.483-.174-.711-.703-.59-1.202zm-16.5.52q1.485-.305 3-.52m0 0l2.62 10.726c.122.499-.106 1.028-.589 1.202a6 6 0 0 1-2.031.352a6 6 0 0 1-2.031-.352c-.483-.174-.711-.703-.59-1.202z\"\u002F>",{"left":4,"top":4,"width":5,"height":5,"rotate":4,"vFlip":6,"hFlip":6,"body":25},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"1.5\" d=\"M15.75 5.25a3 3 0 0 1 3 3m3 0a6 6 0 0 1-7.029 5.912c-.563-.097-1.159.026-1.563.43L10.5 17.25H8.25v2.25H6v2.25H2.25v-2.818c0-.597.237-1.17.659-1.591l6.499-6.499c.404-.404.527-1 .43-1.563A6 6 0 1 1 21.75 8.25\"\u002F>",{"left":4,"top":4,"width":5,"height":5,"rotate":4,"vFlip":6,"hFlip":6,"body":27},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"1.5\" d=\"M7.864 4.243A7.5 7.5 0 0 1 19.5 10.5c0 2.92-.556 5.709-1.568 8.269M5.742 6.364A7.47 7.47 0 0 0 4.5 10.5a7.46 7.46 0 0 1-1.15 3.993m1.989 3.559A11.2 11.2 0 0 0 8.25 10.5a3.75 3.75 0 1 1 7.5 0q0 .79-.064 1.565M12 10.5a14.94 14.94 0 0 1-3.6 9.75m6.633-4.596a18.7 18.7 0 0 1-2.485 5.33\"\u002F>",{"left":4,"top":4,"width":5,"height":5,"rotate":4,"vFlip":6,"hFlip":6,"body":29},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"1.5\" d=\"M8.25 3v1.5M4.5 8.25H3m18 0h-1.5M4.5 12H3m18 0h-1.5m-15 3.75H3m18 0h-1.5M8.25 19.5V21M12 3v1.5m0 15V21m3.75-18v1.5m0 15V21m-9-1.5h10.5a2.25 2.25 0 0 0 2.25-2.25V6.75a2.25 2.25 0 0 0-2.25-2.25H6.75A2.25 2.25 0 0 0 4.5 6.75v10.5a2.25 2.25 0 0 0 2.25 2.25m.75-12h9v9h-9z\"\u002F>",{"left":4,"top":4,"width":5,"height":5,"rotate":4,"vFlip":6,"hFlip":6,"body":31},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"1.5\" d=\"M19.5 14.25v-2.625a3.375 3.375 0 0 0-3.375-3.375h-1.5A1.125 1.125 0 0 1 13.5 7.125v-1.5a3.375 3.375 0 0 0-3.375-3.375H8.25m0 12.75h7.5m-7.5 3H12M10.5 2.25H5.625c-.621 0-1.125.504-1.125 1.125v17.25c0 .621.504 1.125 1.125 1.125h12.75c.621 0 1.125-.504 1.125-1.125V11.25a9 9 0 0 0-9-9\"\u002F>",{"left":4,"top":4,"width":5,"height":5,"rotate":4,"vFlip":6,"hFlip":6,"body":33},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"1.5\" d=\"M12 9v3.75m0-10.036A11.96 11.96 0 0 1 3.598 6A12 12 0 0 0 3 9.75c0 5.592 3.824 10.29 9 11.622c5.176-1.332 9-6.03 9-11.622c0-1.31-.21-2.57-.598-3.75h-.152c-3.196 0-6.1-1.25-8.25-3.286m0 13.036h.008v.008H12z\"\u002F>",{"left":4,"top":4,"width":5,"height":5,"rotate":4,"vFlip":6,"hFlip":6,"body":35},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"1.5\" d=\"M9 12.75L11.25 15L15 9.75m-3-7.036A11.96 11.96 0 0 1 3.598 6A12 12 0 0 0 3 9.749c0 5.592 3.824 10.29 9 11.623c5.176-1.332 9-6.03 9-11.622c0-1.31-.21-2.571-.598-3.751h-.152c-3.196 0-6.1-1.248-8.25-3.285\"\u002F>",{"id":37,"documentId":38,"title":39,"content":40,"slug":41,"published":42,"createdAt":43,"updatedAt":43,"publishedAt":44,"locale":45,"authorManual":46,"cover":47,"tags":98,"seo":117,"author":51},127,"wqsmsvj6egog03ftm2tdyawe","[YubiOn WindowsLogon Standalone] Aggegrate Event Viewer Logs to another PC","\u003Cp>Updated: Mar 22, 2023\u003C\u002Fp>\n\u003Cp>\u003Ca href=\"https:\u002F\u002Fwww.yubion.com\u002Fyubion\">\u003Cstrong>YubiOn WindowsLogon Standalone\u003C\u002Fstrong>\u003C\u002Fa> is a standalone Windows logon enhancement product that operates on a single PC with the software installed.\u003C\u002Fp>\n\u003Cp>The log at the time of logon can also be checked only on that PC. But we received a consultation about whether it is possible to transfer the logs and aggregate them in another location (AD server, etc.) for confirmation.\u003C\u002Fp>\n\u003Cp>Since this is a standalone product, it does not have a function to link with other servers. But the logs are output to the Application log of the event viewer of that PC.\u003C\u002Fp>\n\u003Cp>Using Windows functions to aggregate the events on another PC makes it possible to check the event log on another server.\u003C\u002Fp>\n\u003Cp>\u003Cimg src=\"https:\u002F\u002Fdty9gbw7gew16.cloudfront.net\u002Fuploads\u002Fblog_aggregate_yubion_windows_event_logs_another_pc_1_edbee6be9f.png\" alt=\"イベントログを転送する\">\u003C\u002Fp>\n\u003Cp>So, I will introduce how to aggregate Windows Event Viewer logs to another PC.\u003C\u002Fp>\n\u003Cblockquote>\n\u003Cp>\u003Cstrong>Table of Contents\u003C\u002Fstrong>\u003C\u002Fp>\n\u003C\u002Fblockquote>\n\u003Cul>\n\u003Cli>\u003Cp>\u003Ca href=\"#viewer-a45be\">Environment\u003C\u002Fa>\u003C\u002Fp>\n\u003C\u002Fli>\n\u003Cli>\u003Cp>\u003Ca href=\"#viewer-2k3c2\">Setup steps\u003C\u002Fa>\u003C\u002Fp>\n\u003Cul>\n\u003Cli>\u003Cp>\u003Ca href=\"#viewer-1kb5g\">Processes on the source machine\u003C\u002Fa>\u003C\u002Fp>\n\u003Cul>\n\u003Cli>\u003Ca href=\"#viewer-8mvcp\">Prepare to collect logs\u003C\u002Fa>\u003C\u002Fli>\n\u003C\u002Ful>\n\u003C\u002Fli>\n\u003Cli>\u003Cp>\u003Ca href=\"#viewer-659kd\">Processes on the collector machine\u003C\u002Fa>\u003C\u002Fp>\n\u003Cul>\n\u003Cli>\u003Ca href=\"#viewer-1nb49\">Prepare to collect logs\u003C\u002Fa>\u003C\u002Fli>\n\u003Cli>\u003Ca href=\"#viewer-a2n02\">S\u003C\u002Fa>et subscription\u003C\u002Fli>\n\u003C\u002Ful>\n\u003C\u002Fli>\n\u003C\u002Ful>\n\u003C\u002Fli>\n\u003Cli>\u003Cp>\u003Ca href=\"#viewer-92q3p\">Confirm the events\u003C\u002Fa>\u003C\u002Fp>\n\u003C\u002Fli>\n\u003Cli>\u003Cp>\u003Ca href=\"#viewer-b8rfg\">Summary\u003C\u002Fa>\u003C\u002Fp>\n\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Cblockquote>\n\u003Cp>\u003Cstrong>Environment\u003C\u002Fstrong>\u003C\u002Fp>\n\u003C\u002Fblockquote>\n\u003Cp>I have tried the following settings:\u003C\u002Fp>\n\u003Cp>Transfer can also be performed in the workspace environment, but the steps are slightly increased, so we will set it up in the domain environment this time.\u003C\u002Fp>\n\u003Cp>\u003Cstrong>Collector machine (PC for collecting logs)\u003C\u002Fstrong>\u003C\u002Fp>\n\u003Cp>OS: Windows Server 2022\u003C\u002Fp>\n\u003Cp>Active Directory\u003C\u002Fp>\n\u003Cp>\u003Cstrong>Source machine (PC sending logs)\u003C\u002Fstrong>\u003C\u002Fp>\n\u003Cp>OS: Windows 10\u003C\u002Fp>\n\u003Cp>Join the domain of the collector machine\u003C\u002Fp>\n\u003Cp>YubiOn WindowsLogon Standalone configured\u003C\u002Fp>\n\u003Cp>Assume an environment where \u003Cstrong>YubiOn WindowsLogon Standalone\u003C\u002Fstrong> is installed on the source machine. Set the event log (Application log) to be checked on the collect machine.\u003C\u002Fp>\n\u003Cblockquote>\n\u003Cp>\u003Cstrong>Setup steps\u003C\u002Fstrong>\u003C\u002Fp>\n\u003C\u002Fblockquote>\n\u003Ch3>\u003Cstrong>■\u003C\u002Fstrong> \u003Cstrong>Processes on the source machine\u003C\u002Fstrong>\u003C\u002Fh3>\n\u003Ch4>**・**\u003Cstrong>Prepare to collect logs\u003C\u002Fstrong>\u003C\u002Fh4>\n\u003Cp>We will use WinRM (Windows Remote Management) service to forward the events, so make it ready.\u003C\u002Fp>\n\u003Cp>Log on to the source machine with an administrator account, run PowerShell as an administrator, and execute the following command.\u003C\u002Fp>\n\u003Cpre>\u003Ccode>winrm quickconfig\n\u003C\u002Fcode>\u003C\u002Fpre>\n\u003Cp>You will be asked to confirm the execution, so enter "y" to execute.\u003C\u002Fp>\n\u003Cpre>\u003Ccode>PS C:\\Windows\\system32> winrm quickconfig\nWinRM is not set up to receive requests on this machine.\nThe following changes must be made:\n\nStart the WinRM service.\nSet the WinRM service type to delayed auto start.\n\nMake these changes [y\u002Fn]? y\n\nWinRM has been updated to receive requests.\n\nWinRM service type changed successfully.\nWinRM service started.\nWinRM is not set up to allow remote access to this machine for management.\nThe following changes must be made:\n\nEnable the WinRM firewall exception.\nConfigue the LocalAccountTokenFilterPolicy to grant administrative rights remotely to local users.\nMake these changes [y\u002Fn]? y\n\nWinRM has been updated for remote management.\n\nWinRM firewall exception enabled.\nConfiged LocalAccountTokenFilterPolicy to grant administrative rights remotely to local users.\n\u003C\u002Fcode>\u003C\u002Fpre>\n\u003Cp>You have successfully set it.\u003C\u002Fp>\n\u003Cp>※ If your network is public, you cannot set the firewall. In that case, change to a domain or private network.\u003C\u002Fp>\n\u003Cp>Then add the collector machine's account to the Event Log Readers group on the source machine.\u003C\u002Fp>\n\u003Cp>Open "Local Users and Groups" in Windows and open "Event Log Readers" in "Groups".\u003C\u002Fp>\n\u003Cp>\u003Cimg src=\"https:\u002F\u002Fdty9gbw7gew16.cloudfront.net\u002Fuploads\u002Fblog_aggregate_yubion_windows_event_logs_another_pc_2_3e3f50d531.png\" alt=\"ローカルユーザーとグループ設定\">\u003C\u002Fp>\n\u003Cp>Click "Add".\u003C\u002Fp>\n\u003Cp>By default, computer accounts cannot be added, so click "Object Types...", check "Computers" and return by "OK".\u003C\u002Fp>\n\u003Cp>\u003Cimg src=\"https:\u002F\u002Fdty9gbw7gew16.cloudfront.net\u002Fuploads\u002Fblog_aggregate_yubion_windows_event_logs_another_pc_3_21c76d5a6d.png\" alt=\"オブジェクトの種類\">\u003C\u002Fp>\n\u003Cp>Enter the computer name of the collector machine into the "Enter the object names to select" input field and confirm with "OK".\u003C\u002Fp>\n\u003Cp>\u003Cimg src=\"https:\u002F\u002Fdty9gbw7gew16.cloudfront.net\u002Fuploads\u002Fblog_aggregate_yubion_windows_event_logs_another_pc_4_0c0c91bdec.png\" alt=\"ホスト名を入力\">\u003C\u002Fp>\n\u003Cp>The computer name of the collector machine has been added to "Members".\u003C\u002Fp>\n\u003Cp>Close with "OK".\u003C\u002Fp>\n\u003Cp>\u003Cimg src=\"https:\u002F\u002Fdty9gbw7gew16.cloudfront.net\u002Fuploads\u002Fblog_aggregate_yubion_windows_event_logs_another_pc_5_1d80b46173.png\" alt=\"Event Log Readers設定\">\u003C\u002Fp>\n\u003Cp>※ This time, it is not necessary because it is a domain environment, but when set in a workgroup environment, add an account with administrator privileges.\u003C\u002Fp>\n\u003Cp>Next, we move on to processes on the collector machine.\u003C\u002Fp>\n\u003Ch3>\u003Cstrong>■\u003C\u002Fstrong> \u003Cstrong>Processes on the collector machine\u003C\u002Fstrong>\u003C\u002Fh3>\n\u003Ch4>**・**\u003Cstrong>Prepare to collect logs\u003C\u002Fstrong>\u003C\u002Fh4>\n\u003Cp>Log on to the collector machine with an administrator account, run PowerShell as an administrator, and execute the following command.\u003C\u002Fp>\n\u003Cpre>\u003Ccode>wecutil quick-config\n\u003C\u002Fcode>\u003C\u002Fpre>\n\u003Cp>You will be asked to confirm the execution, so enter "y" to execute.す。\u003C\u002Fp>\n\u003Cpre>\u003Ccode>The service startup mode will be changed to Delay-Start. Would ou like to proceed ( Y- yes or N- no)? y\n\nWindows Event Collector service was configured successfully.\n\u003C\u002Fcode>\u003C\u002Fpre>\n\u003Ch4>**・**\u003Cstrong>Set subscription\u003C\u002Fstrong>\u003C\u002Fh4>\n\u003Cp>Define what kind of event logs to transfer using the subscription function.\u003C\u002Fp>\n\u003Cp>Launch Event Viewer on the collector machine.\u003C\u002Fp>\n\u003Cp>Select "Subscriptions" under "Application and Service Logs".\u003C\u002Fp>\n\u003Cp>Click "Create Subscription...".\u003C\u002Fp>\n\u003Cp>\u003Cimg src=\"https:\u002F\u002Fdty9gbw7gew16.cloudfront.net\u002Fuploads\u002Fblog_aggregate_yubion_windows_event_logs_another_pc_6_0266557ad0.png\" alt=\"サブスクリプションの作成\">\u003C\u002Fp>\n\u003Cp>Enter any "Subscription name" and "Description" and click "Select Computers...".\u003C\u002Fp>\n\u003Cp>Select from the pulldown to change the destination log.\u003C\u002Fp>\n\u003Cp>We will use the default "Forwarded Events" this time.\u003C\u002Fp>\n\u003Cp>\u003Cimg src=\"https:\u002F\u002Fdty9gbw7gew16.cloudfront.net\u002Fuploads\u002Fblog_aggregate_yubion_windows_event_logs_another_pc_7_70c6839a4a.png\" alt=\"サブスクリプションのプロパティ\">\u003C\u002Fp>\n\u003Cp>Specify the source machine.\u003C\u002Fp>\n\u003Cp>Click "Add Domain Computers..." under "Collector initiated".\u003C\u002Fp>\n\u003Cp>\u003Cimg src=\"https:\u002F\u002Fdty9gbw7gew16.cloudfront.net\u002Fuploads\u002Fblog_aggregate_yubion_windows_event_logs_another_pc_8_8274ebd145.png\" alt=\"\">\u003C\u002Fp>\n\u003Cp>Enter the computer name of the target source machine and click "OK".\u003C\u002Fp>\n\u003Cp>\u003Cimg src=\"https:\u002F\u002Fdty9gbw7gew16.cloudfront.net\u002Fuploads\u002Fblog_aggregate_yubion_windows_event_logs_another_pc_9_d0af453ba9.png\" alt=\"コンピュータ名を入力\">\u003C\u002Fp>\n\u003Cp>If you want to register multiple PCs, register the PCs one after the other.\u003C\u002Fp>\n\u003Cp>And, you can check that you can access the target PC by clicking the "Test" button.\u003C\u002Fp>\n\u003Cp>Click "Select Events...".\u003C\u002Fp>\n\u003Cp>Here you specify the logs you want to send as events.\u003C\u002Fp>\n\u003Cp>\u003Cstrong>YubiOn WindowsLogon Standalone\u003C\u002Fstrong> logs are output to the Application log, so specify to transfer all Application logs.\u003C\u002Fp>\n\u003Cp>\u003Cimg src=\"https:\u002F\u002Fdty9gbw7gew16.cloudfront.net\u002Fuploads\u002Fblog_aggregate_yubion_windows_event_logs_another_pc_10_01faba4cfe.png\" alt=\"クエリフィルター\">\u003C\u002Fp>\n\u003Cp>Click "Advanced..." to confirm.\u003C\u002Fp>\n\u003Cp>Leave the defaults here, select "Machine Account" for "User Account", and select "Normal" for "Event Delivery Optimization".\u003C\u002Fp>\n\u003Cp>\u003Cimg src=\"https:\u002F\u002Fdty9gbw7gew16.cloudfront.net\u002Fuploads\u002Fblog_aggregate_yubion_windows_event_logs_another_pc_11_c91c49804e.png\" alt=\"サブスクリプションの詳細設定\">\u003C\u002Fp>\n\u003Cp>Your subscription has been added.\u003C\u002Fp>\n\u003Cp>Make sure the status is active.\u003C\u002Fp>\n\u003Cp>\u003Cimg src=\"https:\u002F\u002Fdty9gbw7gew16.cloudfront.net\u002Fuploads\u002Fblog_aggregate_yubion_windows_event_logs_another_pc_12_8e99e16a2a.png\" alt=\"サブスクリプション追加\">\u003C\u002Fp>\n\u003Cp>The settings for collecting events are now complete.\u003C\u002Fp>\n\u003Cblockquote>\n\u003Cp>\u003Cstrong>Confirm the events\u003C\u002Fstrong>\u003C\u002Fp>\n\u003C\u002Fblockquote>\n\u003Cp>Now let's confirm that the event logs are transferred.\u003C\u002Fp>\n\u003Cp>First, log on to the \u003Cstrong>source machine\u003C\u002Fstrong> using \u003Cstrong>YubiOn WindowsLogon Standalone\u003C\u002Fstrong>.\u003C\u002Fp>\n\u003Cp>Screen lock the source machine once and log on using the YubiKey.\u003C\u002Fp>\n\u003Cp>This printed a log for the "YubiOnWindowsLogonStandalone" source in the Application log.\u003C\u002Fp>\n\u003Cp>Here is the log when the logon is successful.\u003C\u002Fp>\n\u003Cp>\u003Cimg src=\"https:\u002F\u002Fdty9gbw7gew16.cloudfront.net\u002Fuploads\u002Fblog_aggregate_yubion_windows_event_logs_another_pc_13_adc88264ff.png\" alt=\"ソースマシン側のイベントビューアー\">\u003C\u002Fp>\n\u003Cp>Event Viewer on the source machine\u003C\u002Fp>\n\u003Cp>The logon account name and the PublicID (identification ID) of the YubiKey used are output.\u003C\u002Fp>\n\u003Cp>Next, let's check the Event Viewer of the \u003Cstrong>collector machine\u003C\u002Fstrong>.\u003C\u002Fp>\n\u003Cp>Log on to the collector machine and open "\u003Cstrong>Windows Logs\u003C\u002Fstrong>" \u003Cstrong>> "Forwarded Events\u003C\u002Fstrong>" in Event Viewer.\u003C\u002Fp>\n\u003Cp>\u003Cimg src=\"https:\u002F\u002Fdty9gbw7gew16.cloudfront.net\u002Fuploads\u002Fblog_aggregate_yubion_windows_event_logs_another_pc_14_69ba5f54c6.png\" alt=\"コレクトマシン側のイベントビューアー\">\u003C\u002Fp>\n\u003Cp>Event Viewer on the collector machine\u003C\u002Fp>\n\u003Cp>YubiOn's successful logon log was transferred to the collector machine.\u003C\u002Fp>\n\u003Cp>※ It may take some time (about 15 minutes) to be transferred.\u003C\u002Fp>\n\u003Cp>If you have registered multiple PCs, you can identify them by computer name.\u003C\u002Fp>\n\u003Cblockquote>\n\u003Cp>\u003Cstrong>Summary\u003C\u002Fstrong>\u003C\u002Fp>\n\u003C\u002Fblockquote>\n\u003Cp>By using the log transfer function of Windows, you can transfer the Event Viewer log output by \u003Cstrong>YubiOn WindowsLogon Standalone\u003C\u002Fstrong>.\u003C\u002Fp>\n\u003Cp>This time, I set it to transfer all Application logs, but I think it would be easier to check the necessary logs by transferring only the necessary logs or using a filter.\u003C\u002Fp>\n\u003Cp>Also, this time I introduced the procedure to set the source machines one by one, but if there are many machines and it takes time and effort, it is possible to reduce the time and effort by using the AD group policy.\u003C\u002Fp>\n\u003Cp>Please refer to the \u003Ca href=\"https:\u002F\u002Fwww.yubion.com\u002Fyubion\">i\u003C\u002Fa>ntroduction page for details of the \u003Ca href=\"https:\u002F\u002Fwww.yubion.com\u002Fyubion\">\u003Cstrong>YubiOn WindowsLogon Standalone\u003C\u002Fstrong>\u003C\u002Fa>.\u003C\u002Fp>\n\u003Cp>Thank you for reading to the end.\u003C\u002Fp>\n","aggregate-yubion-windows-event-logs-another-pc","2023-02-21","2026-04-28T07:34:07.728Z","2026-04-28T07:34:11.402Z","en","YubiOnstaff",{"id":48,"documentId":49,"name":50,"alternativeText":51,"caption":51,"focalPoint":51,"width":52,"height":53,"formats":54,"hash":93,"ext":56,"mime":60,"size":94,"url":95,"previewUrl":51,"provider":96,"provider_metadata":51,"createdAt":97,"updatedAt":97,"publishedAt":97},1059,"ki84rs8zk1b37ds5awi64ndv","blog-aggregate-yubion-windows-event-logs-another-pc-1.png",null,1596,864,{"large":55,"small":66,"medium":75,"thumbnail":84},{"ext":56,"url":57,"etag":58,"hash":59,"mime":60,"name":61,"path":51,"size":62,"width":63,"height":64,"sizeInBytes":65},".png","https:\u002F\u002Fdty9gbw7gew16.cloudfront.net\u002Fuploads\u002Flarge_blog_aggregate_yubion_windows_event_logs_another_pc_1_edbee6be9f.png","4e7eb5800d459a0a989033eba8def403","large_blog_aggregate_yubion_windows_event_logs_another_pc_1_edbee6be9f","image\u002Fpng","large_blog-aggregate-yubion-windows-event-logs-another-pc-1.png",99.01,1000,541,99009,{"ext":56,"url":67,"etag":68,"hash":69,"mime":60,"name":70,"path":51,"size":71,"width":72,"height":73,"sizeInBytes":74},"https:\u002F\u002Fdty9gbw7gew16.cloudfront.net\u002Fuploads\u002Fsmall_blog_aggregate_yubion_windows_event_logs_another_pc_1_edbee6be9f.png","86e7e219b77f8ffb6d2a3ade8d0c3938","small_blog_aggregate_yubion_windows_event_logs_another_pc_1_edbee6be9f","small_blog-aggregate-yubion-windows-event-logs-another-pc-1.png",40.28,500,271,40275,{"ext":56,"url":76,"etag":77,"hash":78,"mime":60,"name":79,"path":51,"size":80,"width":81,"height":82,"sizeInBytes":83},"https:\u002F\u002Fdty9gbw7gew16.cloudfront.net\u002Fuploads\u002Fmedium_blog_aggregate_yubion_windows_event_logs_another_pc_1_edbee6be9f.png","ecbea14dce133b092b9412cc39883f2d","medium_blog_aggregate_yubion_windows_event_logs_another_pc_1_edbee6be9f","medium_blog-aggregate-yubion-windows-event-logs-another-pc-1.png",68.09,750,406,68086,{"ext":56,"url":85,"etag":86,"hash":87,"mime":60,"name":88,"path":51,"size":89,"width":90,"height":91,"sizeInBytes":92},"https:\u002F\u002Fdty9gbw7gew16.cloudfront.net\u002Fuploads\u002Fthumbnail_blog_aggregate_yubion_windows_event_logs_another_pc_1_edbee6be9f.png","507ef1e2eaebcdfc1edd92462a98d0a3","thumbnail_blog_aggregate_yubion_windows_event_logs_another_pc_1_edbee6be9f","thumbnail_blog-aggregate-yubion-windows-event-logs-another-pc-1.png",15.5,245,133,15498,"blog_aggregate_yubion_windows_event_logs_another_pc_1_edbee6be9f",30.39,"https:\u002F\u002Fdty9gbw7gew16.cloudfront.net\u002Fuploads\u002Fblog_aggregate_yubion_windows_event_logs_another_pc_1_edbee6be9f.png","aws-s3","2026-04-28T07:32:53.378Z",[99,105,111],{"id":100,"documentId":101,"name":102,"slug":51,"createdAt":103,"updatedAt":103,"publishedAt":104},2,"b4q0trycp73vvz9to2sifded","WindowsLogon","2026-04-27T05:40:37.089Z","2026-04-27T05:40:38.474Z",{"id":106,"documentId":107,"name":108,"slug":51,"createdAt":109,"updatedAt":109,"publishedAt":110},34,"v4n7em89yu17bwvvo1n3blmj","WindowsStandalone","2026-04-28T05:17:23.012Z","2026-04-28T05:17:24.943Z",{"id":112,"documentId":113,"name":114,"slug":51,"createdAt":115,"updatedAt":115,"publishedAt":116},102,"uqbg02l5gzj5wkl3gqtns0wx","SettingGuide","2026-04-28T06:46:52.463Z","2026-04-28T06:46:54.313Z",{"id":118,"metaDescription":119},361,"Learn how to aggregate YubiOn WindowsLogon Standalone event logs to another PC or server using Windows functions.",{"left":4,"top":4,"width":5,"height":5,"rotate":4,"vFlip":6,"hFlip":6,"body":121},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"1.5\" d=\"M15.75 6a3.75 3.75 0 1 1-7.5 0a3.75 3.75 0 0 1 7.5 0M4.501 20.118a7.5 7.5 0 0 1 14.998 0A17.9 17.9 0 0 1 12 21.75c-2.676 0-5.216-.584-7.499-1.632\"\u002F>",1783406315245]