Steffen on logrotation push file to another destination. \Log-SecurityEvents_Archiving true <QueryList><Query Id="0" Path="Security"><Select Path="Security">*[System[Provider[@Name='Microsoft-Windows-Eventlog'] and EventID=1105]]</Select></Query></QueryList> Event/UserData/AutoBackup/BackupPath S-1-5-21-xxxxxxxx-xxxxxxx-xxxxxxxx-xxxxxxx S4U HighestAvailable Queue true true true false false true false true true false false false PT72H 7 C:\Scripts\LogPushToServer.cmd $(BackupFile)