I have 2 Windows Server 2016 boxes (a forwader and a collector).
They are in the same subnet and both are workgroup.
Unfortunately, these servers cannot be joined to any domain.
Just as the title states. Is it possible for WEF to work on workgroup computers?
WEF is compatible with both domain and workgroup computers. However, it requires for workgroup computers to use a TLS certificate. For that you will need to have a PKI in place (Windows ADCS can be used) in order to establish the connection as a first step. More informatin can be found in :
https://docs.microsoft.com/fr-fr/archive/blogs/thedutchguy/windows-event-forwarding-to-a-workgroup-collector-server
https://docs.microsoft.com/en-us/windows/win32/wec/setting-up-a-source-initiated-subscription