Windows Event Forwarding

Look at Event Viewer Subscriptions

Use wecutil

Enumerate subscriptions

wecutil es

Look at more info for a subscription

wecutil gs SUBSCRIPTION_NAME