The Windows Event Collector (WEC) is bundled into the syslog-ng PE installers from version 7.0.6 onward and is installed automatically. By installing syslog-ng PE, you also install WEC. A systemd service file is provided, however, syslog-ng-wec is not registered to start at boot.
To install the Windows Event Collector
To start syslog-ng-wec at boot, register the init script using the systemctl enable syslog-ng-wec command.
For details on how to start syslog-ng-wec manually, see Starting/stopping Windows Event Collector.