> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/broker-vm/set-up-and-configure-broker-vm/broker-vm-data-collector-applets/activate-windows-event-collector/renew-wec-certificates.md).

# Renew WEC certificates

Renewing your WEC certificates in Cortex XDR includes renewing your Windows Event Forwarding (WEF) client certificate and your WEC server certificate. You must install the WEF certificate on every Windows server, whether a Domain Controller (DC) or not, for the WEFs that are supposed to forward logs to the Windows Event Collector applet on the Broker VM.

{% hint style="info" %}

### Important

After you receive a notification for renewing your WEC CA certificate, we recommend that you do not add any new WEF clients until the WEC certification renewal process is complete. Events from these WEF clients that are added afterwards will not be collected by the server until the WEC certificates are renewed.
{% endhint %}

In addition, Cortex XDR manages the renewal of your WEC certificates by implementing the following time limits:

* The WEC CA certificate is increased for an extended period of time for a maximum of 20 years.
* The Broker VM applet includes an automatic renewal mechanism for a WEC server certificate, which has a lifespan of 12 months.
* The WEC client certificate after the renewal is issued with a lifespan of 5 years.

Perform the following procedures in the order listed below.

<details>

<summary>Task 1. Renew your WEF client certificate in Cortex XDR</summary>

1. Select **Settings** → **Configurations** → **Data Broker** → **Broker VMs**.
2. Do one of the following:
   * On the **Brokers** tab, find the Broker VM, and in the **APPS** column, left-click the **WEC** connection to display the Windows Event Collector settings, and select **Configure**.
   * On the **Clusters** tab, find the Broker VM, and in the **APPS** column, left-click the **WEC** connection to display the Windows Event Collector settings, and select **Configure**.
3. In the **Windows Event Forwarder Configuration** window, perform the following tasks:
   1. In the **Subscription Manager URL** field, click ![copy-icon.png](/files/Zp7ls2fAjP2gs6hwcuSv) (copy) . This will be used when you configure the subscription manager in the GPO (Global Policy Object) on your domain controller.
   2. Enter a password in the **Define Client Certificate Export Password** field to be used to secure the downloaded WEF certificate that establishes the connection between your DC/WEF and the WEC. You will need this password when the certificate is imported to the events forwarder.
   3. Download the WEF certificate in a PFX format to your local machine.
4. Install your WEF Certificate on the WEF to establish connection.

   <div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><h3>Note</h3><p>You must install the WEF certificate on every Windows Server, whether DC or not, for the WEFs that are supposed to forward logs to the Windows Event Collector applet on the Broker VM.</p></div>

   1. Locate the PFX file you downloaded from the Cortex XDR console and double-click to open the **Certificate Import Wizard**.
   2. In the **Certificate Import Wizard**:
      1. Select **Local Machine**, and then click **Next**.
      2. Verify the **File name** field displays the PFX certificate file you downloaded and click **Next**.
      3. In the **Passwords** field, enter the Client Certificate Export Password you defined in the Cortex XDR console followed by **Next**.
      4. Select **Automatically select the certificate store based on the type of certificate, and then click** **Next** and **Finish**.
   3. From a command prompt, run `certlm.msc`.
   4. In the file explorer, navigate to **Certificates** and verify the following for each of the folders:

      * In the **Personal** → **Certificates** folder, ensure the certificate `forwarder.wec.paloaltonetworks.com` is displayed.
      * In the **Trusted Root Certification Authorities** → **Certificates** folder, ensure the CA `ca.wec.paloaltonetworks.com` is displayed.

      <div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><h3>Note</h3><p>You can see more than one <code>ca.wec.paloaltonetworks.com</code> and <code>forwarder.wec.paloaltonetworks.com</code> file from a previous installation in the directory, so select the file with the most extended <strong>Expiration Date</strong>. You can verify that you are using the correct certificate:</p><ul><li>To verify the client certificate in the Personal → <strong>Certificates</strong> folder is related to the CA, you can select your <code>forwarder.wec.paloaltonetworks.com</code> file and from the <strong>Certification Path</strong> tab, double-click <strong>ca.wec.paloaltonetworks.com</strong>. In the <strong>Details</strong> tab, <strong>Show: Properties only</strong>, and verify the <strong>Thumbprint</strong> matches the <code>ca.wec.paloaltonetworks.com</code> file <strong>Thumbprint</strong>.</li><li>For the Trusted Root Certificate (i.e. CA certificate), you can verify the <strong>Thumbprint</strong> of your <code>ca.wec.paloaltonetworks.com</code> file matches the Subscription Manager URL by double-clicking the file and from the <strong>Details</strong> tab verifying the <strong>Thumbprint</strong>.</li></ul></div>
   5. Navigate to **Certificates** **Personal** **Certificates**.
   6. Right-click the certificate and navigate to **All tasks** → **Manage Private Keys**.
   7. In the **Permissions** window, select **Add** and in the **Enter the object name** section, enter **`NETWORK SERVICE`**, and then click **Check Names** to verify the object name. The object name is displayed with an underline when valid. and then click **OK**.

      ![certificate-permission.png](/files/z7GhyVHmvaIplLbw1sK6)
   8. Click **OK**, verify the **Group or user names** that are displayed, and then click **Apply Permissions for private keys**.

      ![verify-permissions.png](/files/XjExbGJSeiRb7mo3TShp)
5. Configure the subscription manager.
   1. Navigate to **Computer Configuration** → **Policies** → **Administrative Templates: Policy definitions** → **Windows Components** → **Event Forwarding**, right-click **Configure target Subscription Manager** and select **Edit**.

      ![target-subscription-manager.png](/files/8zuPPwjCnlT7aI3DweTX)
   2. In the **Configure target Subscription Manager** window, perform the following:
      1. Mark **Configure target Subscription Manager** as **Enabled**.
      2. In the **Options** section, select **Show** and in the **Show Contents** window, paste the Subscription Manage URL you copied from the Cortex XDR console, and then click **OK**.
      3. Click **Apply** and **OK** to save your changes.
6. Complete the WEF Client certificate renewal.

   On every WEF DC, perform the following from a command prompt:

   1. Run `gpupdate /force` to update the group policy.
   2. To apply the configurations, `Restart-Service WinRM`.

</details>

<details>

<summary>Task 2. Renew your WEC server certificate in Cortex XDR</summary>

{% hint style="info" %}

### Note

Only perform this step under the following conditions:

* You have completed the WEF certification renewal process for ALL clients in your environment. Otherwise, events from the WEFs that you did not install the new client certificate will not be collected by the WEC.
* You are approaching the WEC server CA certificate expiration date, which is 2 years after the **Windows Event Collector** applet activation, and receive a notification in the Cortex XDR console.
  {% endhint %}

1. Select **Settings** → **Configurations** → **Data Broker** → **Broker VMs**.
2. Do one of the following:
   * On the **Brokers** tab, find the Broker VM, and in the **APPS** column, left-click the **WEC** connection to display the Windows Event Collector settings, and select **Renew WEC Server Certificate**.
   * On the **Clusters** tab, find the Broker VM, and in the **APPS** column, left-click the **WEC** connection to display the Windows Event Collector settings, and select **Renew WEC Server Certificate**.
3. Click **Renew**.

   Once Cortex XDR renews the WEC server certificate, the status of the **WEC** in the **APPS** field on the **Broker VMs** machine is **Connected** indicating the applet is running. In addition, the health status of the Windows Event Collector applet is now green instead of yellow and the warning message that appeared when you hovered over the health status no longer appears. Your WEC server certificate is issued with a lifespan of 12 months.

   We also suggest that you run the following XQL query to verify that your event logs are being captured:

   ```programlisting
   dataset = xdr_data 
   | filter _product = "Windows" 
   | fields _vendor,_product,action_evtlog_level,action_evtlog_event_id 
   | sort desc _time 
   | limit 20
   ```

   <div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><h3>Note</h3><p>If this query does not display results with a timestamp from after the renewal process, it could indicate that the renewal process is not complete, so wait a few minutes before running another query. If you are still having a problem, contact Technical Support.</p></div>

</details>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/broker-vm/set-up-and-configure-broker-vm/broker-vm-data-collector-applets/activate-windows-event-collector/renew-wec-certificates.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.