I've Googled this and haven't found any answers.

(yep, I also posted on TechNet about this)

I have a few workstations that have been decommissioned and are showing as "Inactive". I'd like to remove them from the subscription to minimize the appearance of errors.

The answer here was for Collector-Initiated setups, (which requires you to run C++ code??).

Has anyone found an easy way to remove SOURCE-INITIATED PCs?

2 Answers 2


Check out the "registry size" note on this page.

For each unique device that connects to a WEF subscription, there is a registry key (corresponding to the FQDN of the WEF Client) created to store bookmark and source heartbeat information. If this is not pruned to remove inactive clients this set of registry keys can grow to an unmanageable size over time.

It's as easy as deleting the registry key on the Windows Event Collector server. You could write a script to compare the list of clients in the registry with the list of active clients in your active directory. Then delete the keys for clients that do not exist in AD or haven't authenticated in a while.

These keys are located here on each of your Windows Event Collector servers: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\EventCollector\Subscriptions\<SubscriptionName>

  • Great find! Marking this as the answer.
    – beansbeans
    May 2, 2018 at 14:46

There is a windows command to manage subscriptions, wecutil.exe.


wecutil ss "Event subscription name" /res /esa:eventsourcecomputername.domain.com  
  • This did not work for Source-Initiated devices.
    – beansbeans
    May 2, 2018 at 16:29
  • I'll have to test this later with procmon, but can anyone confirm if running wecutil with /res /esa is simply deleting the WEC server's registry key for the event source computer? Or is it doing something more?
    – twconnell
    May 12, 2018 at 20:22
  • @twconnell: It should delete the registry key and update the event collector service, but there appears to be a defect in wecutil where it does not produce the expected result. I will leave this up in case someone else has other information.
    – Greg Askew
    May 13, 2018 at 16:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.