It seems downright impossible to copy C:\WINDOWS\system32\config\ (Windows event logs) by itself through any normal means outside of event log forwarding. Anyone know a solution?

How are you guys pulling Windows Event Log data from any significant number of hosts for security investigations if a client didn't enable event log forwarding? I have spent my entire day looking for a solution to this.

I know you can do it through the Event Viewer GUI, but that's really not viable for pulling from hundreds of hosts. I have gone to StackOverflow, ServerFault, friends, colleagues, no one seems to know a way to do this. It seems …

copy cybersecurity event event logs forwarding log logs windows windows event logs