// events/1102 · Audit log

Event ID 1102The audit log was cleared

Someone cleared the Windows Security log.

Log	`Security`
Source	`Microsoft-Windows-Security-Auditing`
Area	Audit log

What to check

You should rarely see this. Find out who cleared it (Subject) and why, as clearing the log is a common way to cover tracks.

Find it with PowerShell

Run on the machine that logs it, as an administrator.

powershell2 lines

1
2Get-WinEvent -FilterHashtable @{ LogName = 'Security'; Id = 1102 } -MaxEvents 50 |
    Format-List TimeCreated, Id, Message

Hunt for it in Sentinel or Log Analytics

Security events land in the SecurityEvent table when you collect them with the Windows Security Events connector or a data collection rule.

kql5 lines

1
2
3
4
5SecurityEvent
| where TimeGenerated > ago(7d)
| where EventID == 1102
| project TimeGenerated, Computer, Account, Activity
| order by TimeGenerated desc

Search all 123 event IDs →

Sources

Microsoft documentation for event 1102