I'm looking for a way to automatically save off Windows security event logs from several servers to one central location (connected on the network and domain). I want to be able to do this on a weekly schedule and clear the log afterwards (so that the next save doesn't have any overlap with the previous one).

I have many servers I need to do this on so doing them manually would be inefficient and time consuming and for some reason this functionality was still not in Windows Server in 2008.

I'm not a scripting or development guy by any means but I assume the only way really to do this is to write a script and assign it to a scheduled task. I've looked into this and I can't find anything that works when I try it, either because it's missing some piece of the puzzle or it doesn't work in W2K8. Can anybody give me some direction on this.

If there is any free (or inexpensive) third party software that simplifies this that would work as well.

Thanks in advance for any help.

  • Shopping Questions are considered Off-Topic here on ServerFault. Please see the Help section or Here for more info. If you are interested in having a way to ask these types of questions head over to the IT Shopping Questions Beta and post your question as a possible question for the beta and follow the proposal.
    – TheCleaner
    Commented Sep 6, 2013 at 13:06
  • Setup a Syslog server? Or setup splunk (free depending on how much data is being collected..)
    – Rex
    Commented Sep 6, 2013 at 14:31

1 Answer 1


It would be possible to do this using Event Subscriptions which is a built in feature of Windows 2008. In Windows 2008 you would open Server Manager > Diagnostics > Event Viewer > Subscriptions. This allows you to collect event log entries from remote computers automatically.

Not the answer you're looking for? Browse other questions tagged .