ZEKASTRA

SecurityAudit policy and log integrity

1102 · The audit log was cleared

Generated every time the Windows Security log is cleared. Records the account that cleared it.

01Fields in the event

  • SubjectUserSid
  • SubjectUserName
  • SubjectDomainName
  • SubjectLogonId

02How to use it

Treat it as the start of a known gap. Recover earlier events from forwarded copies (SIEM, Windows Event Forwarding), Volume Shadow Copies or unallocated space, and correlate SubjectLogonId with 4624.

03Caveats

The cited page lists this event under the Other Events subcategory. Its absence does not show that no log was deleted.

05Sources

  1. Microsoft Learn — 1102(S) The audit log was cleared checked 2026-10-18

Contact and service requests

Contact us about examination services related to this page, support for expert witnesses, or collaboration. Please do not attach evidence files or personal data to your email.