Windows Event Collector - Windows 10 Service
This service manages persistent subscriptions to events from remote sources that support WS-Management protocol. This includes Windows Vista event logs, hardware and IPMI-enabled event sources. The service stores forwarded events in a local Event Log. If this service is stopped or disabled event subscriptions cannot be created and forwarded events cannot be accepted.
This service also exists in Windows 11, 8 and Vista.
Startup Type
| Windows 10 version | Home | Pro | Education | Enterprise |
|---|---|---|---|---|
| 1507 | Manual | Manual | Manual | Manual |
| 1511 | Manual | Manual | Manual | Manual |
| 1607 | Manual | Manual | Manual | Manual |
| 1703 | Manual | Manual | Manual | Manual |
| 1709 | Manual | Manual | Manual | Manual |
| 1803 | Manual | Manual | Manual | Manual |
| 1809 | Manual | Manual | Manual | Manual |
| 1903 | Manual | Manual | Manual | Manual |
| 1909 | Manual | Manual | Manual | Manual |
| 2004 | Manual | Manual | Manual | Manual |
| 20H2 | Manual | Manual | Manual | Manual |
| 21H1 | Manual | Manual | Manual | Manual |
| 21H2 | Manual | Manual | Manual | Manual |
| 22H2 | Manual | Manual | Manual | Manual |
Default Properties
| Display name: | Windows Event Collector |
| Service name: | Wecsvc |
| Type: | share |
| Path: | %WinDir%\system32\svchost.exe -k NetworkService -p |
| File: | %WinDir%\system32\wecsvc.dll |
| Error control: | normal |
| Object: | NT AUTHORITY\NetworkService |
| Privileges: |
|
Default Behavior
The Windows Event Collector service is running as NT AUTHORITY\NetworkService in a shared process of svchost.exe. Other services might run in the same process. If Windows Event Collector fails to start, the error is logged. Windows 10 startup proceeds, but a message box is displayed informing you that the Wecsvc service has failed to start.
Dependencies
Windows Event Collector is unable to start, if at least one of the following services is stopped or disabled:
Restore Default Startup Type of Windows Event Collector
Automated Restore
1. Select your Windows 10 edition and release, and then click on the Download button below.
2. Save the RestoreWindowsEventCollectorWindows10.bat file to any folder on your hard drive.
3. Right-click the downloaded batch file and select Run as administrator.
4. Restart the computer to save changes.
Note. Make sure that the wecsvc.dll file exists in the %WinDir%\system32 folder. If this file is missing you can try to restore it from your Windows 10 installation media.