Event ID 1102: the audit log was cleared

Event 1102 is the first entry after someone clears the Security log. Windows always writes it, whatever the audit policy, and it names the account that did it. Clearing logs is rarely part of normal work – but very often part of an attack, right before or after the damage, to hide how the attacker got in.

In short

What it is: the Security log was cleared. Always written, no audit setting needed.
Who: the account in the event (Subject).
Other logs: clearing System, Application or other logs writes Event 104 in the System log.
If you did not expect it: treat it as an incident – the log was cleared for a reason.

1. PowerShell: when and by whom

1102 keeps its fields in a different place than most events (UserData), so it is read directly:

Get-WinEvent -FilterHashtable @{LogName='Security'; Id=1102} -ErrorAction SilentlyContinue |
  ForEach-Object { $u = ([xml]$_.ToXml()).Event.UserData.LogFileCleared
    [pscustomobject]@{ Time = $_.TimeCreated; By = "$($u.SubjectDomainName)\$($u.SubjectUserName)" } }
# other logs cleared (System log, Event 104)
Get-WinEvent -FilterHashtable @{LogName='System'; Id=104} -ErrorAction SilentlyContinue |
  ForEach-Object { $u = ([xml]$_.ToXml()).Event.UserData.LogFileCleared
    [pscustomobject]@{ Time = $_.TimeCreated; Log = $u.Channel; By = "$($u.SubjectDomainName)\$($u.SubjectUserName)" } }

2. Normal or attack?

Normal: rare – an admin clearing a test machine, or a documented procedure. Modern practice is to make the log bigger, not to clear it.
Suspicious: any clearing on a production Server you cannot explain; by an account that does not normally administer the machine; together with new accounts, new services (7045) or a changed audit policy (4719); wevtutil cl in a process command line (4688).

3. What to do

Note the time and the account. Check that account's logons right before it.
Look at what survived elsewhere: the System and Application logs, other Servers, the domain controller (logons and Kerberos), your firewall and VPN logs.
Change the password of the account that cleared the log, and of other admin accounts if you cannot explain it.
For the future: forward Security events to another system (Windows Event Forwarding or a SIEM), so clearing one Server's log does not erase the evidence.

4. Let Coinetic watch it for you

Coinetic keeps the network side of a Server or PC in shape, so attackers rarely get as far as this:

A security check with plain explanations: open ports, risky settings and firewall rules nobody needs any more – each with a severity and a fix you can undo.
Firewall change watch: if something switches the firewall off or opens a port to everyone, Coinetic alerts you and names the program.
Logging kept on: Coinetic keeps the audit settings and the Security log size it needs, and reports audit settings that flood the log.
Ask AI (Pro + AI): “Which finding of the security check should I fix first, and why?”

Protect this Server or PC in 5 minutes

Download Coinetic, install, done: it starts protecting at once. 30 days free with all features, no payment details. From $20 per computer per year.

Start the free 30-day trial →

More guides: all Coinetic guides.

Frequently asked

Can 1102 be prevented?

Only by not giving people the right to clear the log (Manage auditing and security log - administrators have it). Forwarding the events elsewhere is the practical protection.

Why is 1102 the first event in my Security log?

Because the log was cleared, and 1102 is written right after. Everything older is gone from this computer.

Does 1102 appear if the log just fills up?

No. A full log overwrites old events (or stops, depending on the setting) without a 1102. A full log that stopped writing logs Event 1104.