Windows Security Log Event ID 1102

Operating Systems Windows 2008 R2 and 7
Windows 2012 R2 and 8.1
Windows 2016 and 10
Windows Server 2019 and 2022
 • Subcategory
Non Audit (Event Log)
 • Log clear
Type Success
Corresponding events
in Windows 2003
and before

1102: The audit log was cleared

On this page

Event 1102 is logged whenever the Security log is cleared, REGARDLESS of the status of the Audit System Events audit policy. The Account Name and Domain Name fields identify the user who cleared the log.

Logon ID allows you to correlate backwards to the logon event (4624) as well as with other events logged during the same logon session.

Free Security Log Resources by Randy

Description Fields in 1102

  • Subject:
  • Security ID:
  • Account Name:
  • Domain Name:
  • Logon ID:

Supercharger Free Edition

Centrally manage WEC subscriptions.



Examples of 1102

The audit log was cleared.
Security ID: WIN-R9H529RIO4Y\Administrator
Account Name: Administrator
Domain Name: WIN-R9H529RIO4Y
Logon ID: 0x169e9

Top 10 Windows Security Events to Monitor

Free Tool for Windows Event Collection


Additional Resources