WEF

Windows Event Forwarding — the built-in mechanism for shipping subscribed channels to a central collector over WinRM. When WEF is in place, even a cleared local Security log may survive on the collector under the ForwardedEvents channel.