Windows Security Log Event ID 1102

Operating Systems Windows 2008 R2 and 7
Windows 2012 R2 and 8.1
Windows 2016 and 10
 • Subcategory
Non Audit (Event Log)
 • Log clear
Type Success
Corresponding events
in Windows 2003
and before
Discussions on Event ID 1102
Know when other logs are cleared (Windows 2008)

1102: The audit log was cleared

On this page

Event 1102 is logged whenever the Security log is cleared, REGARDLESS of the status of the Audit System Events audit policy. The Account Name and Domain Name fields identify the user who cleared the log.

Logon ID allows you to correlate backwards to the logon event (4624) as well as with other events logged during the same logon session.

Free Security Log Resources by Randy

Description Fields in 1102

  • Subject:
  • Security ID:
  • Account Name:
  • Domain Name:
  • Logon ID:

Supercharger Enterprise


Examples of 1102

The audit log was cleared.
Security ID: WIN-R9H529RIO4Y\Administrator
Account Name: Administrator
Domain Name: WIN-R9H529RIO4Y
Logon ID: 0x169e9

Keep me up-to-date on the Windows Security Log.
*We will NOT share this

Top 10 Windows Security Events to Monitor

Free Tool for Windows Event Collection


Additional Resources