Event ID 1102: The audit log was cleared

Windows Event ID Lookup: What Windows event IDs mean: 4625, 4624, 4740, 6008, 41, 7045, 1102 and 3,000 more, with Windows' own message text, the fields and what to check.

Look up a Windows event ID from Event Viewer, a SIEM alert or a log export: what it means, the fields it records, and what to check. Many IDs are used by more than one source (event 41 is both a Kernel-Power crash and a boot error), so every definition is shown, the one people usually mean first. The message text is Windows' own, read from the event providers of Windows 10.0.26200.0, 2026-10-28; the notes are ours, based on Microsoft's security auditing reference.

Try: 4625, 4624, 4740, 6008, 41, 1074, 7045, 1102, 4104, 1149

The audit log was cleared.

Event 1102

Eventlog

Security / System log

Audit Success

The Security log was cleared. Clearing it needs administrator rights and is rarely part of normal work.

What to check: Subject shows who cleared it. Unexpected clears are a classic sign of an attacker covering their tracks; check other logs and your log collector for what happened just before.

Related: 104, 4719

Message and fields (as Event Viewer shows them)

The audit log was cleared.
Subject:
	Security ID:	…
	Account Name:	…
	Domain Name:	…
	Logon ID:	…

The computer will be rebooted because the user has exceeded the maximum number of failed logon attempts allowed on this computer.

Event 1102

Winlogon

System log

Warning

Message and fields (as Event Viewer shows them)

The computer will be rebooted because the user has exceeded the maximum number of failed logon attempts allowed on this computer.
UserSid: … 
UserName: … 
UserDomain: …