Security Event ID 1102 - The audit log was cleared

Event ID 1102

The audit log was cleared

The audit log was cleared.
Subject:
    Security ID:    %1
    Account Name:   %2
    Domain Name:    %3
    Logon ID:       %4

This event generates every time Windows Security audit log was cleared.

Typically you should not see this event, there is no need to manually clear the Security event log in most cases.

Auditing: Always

Volume: Low

CJIS 5.4.1.1.5.c
ISO 27001:2013 A.12.4.2
PCI 3.2.1: 10.2.3

Microsoft Documentation

Event ID - 1102

	Field	Insertion String	OS	Example
Security ID	SubjectUserSid	%1	Any	Domain\UserName
Account Name	SubjectUserName	%2	Any	UserName
Domain Name	SubjectDomainName	%3	Any	Domain
Logon ID	SubjectLogonId	%4	Any	0x55cd1d

C:\> AuditPol.exe /get /subcategory:"Other System Events"

LEFT/RIGHT arrow keys for navigation