Description:Manages persistent subscriptions to events from remote sources that support the WS-Management protocol. This includes Windows Vista event logs, hardware, and IPMI-enabled event sources. If this service is stopped or disabled, event subscriptions cannot be created and forwarded events cannot be accepted.
More Info MSDN - Windows Event Collector.
- svchost.exe -k NetworkService (Wecsvc)
- Windows Event Log (Win7+)