Event ID: 1102

The audit log was cleared

The audit log was cleared.
    Security ID:    %1
    Account Name:   %2
    Domain Name:    %3
    Logon ID:       %4

This event generates every time Windows Security audit log was cleared.

Typically you should not see this event, there is no need to manually clear the Security event log in most cases.

Auditing:     Always

Volume:     Low

ISO 27001:2013 A.12.4.2
PCI 3.2.1: 10.2.3

Microsoft Documentation

Event ID - 1102

Name Field Insertion String OS Example
Security ID SubjectUserSid %1 Any Domain\UserName
Account Name SubjectUserName %2 Any UserName
Domain Name SubjectDomainName %3 Any Domain
Logon ID SubjectLogonId %4 Any 0x55cd1d

Lookup Audit Policy Configuration Settings

C:\> AuditPol.exe /get /subcategory:"Other System Events"

LEFT/RIGHT arrow keys for navigation

Back to List