The audit log was cleared Primary User Name: %1 Primary Domain: %2 Primary Logon ID: %3 Client User Name: %4 Client Domain: %5 Client Logon ID: %6
Event 517 is logged whenever the Security log is cleared,
REGARDLESS of the status of the Audit System Events audit
policy.
The Primary User Name
and Client User Name fields will identify the user who cleared the log. Primary User Name will correspond to the system, and Client user name will indicate the user who cleared the log.
