thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Security Operations · Intermediate

Event ID 1102

The Windows Security event recorded when the audit log is cleared.

Definition

Clearing the security log is a common anti-forensic action by attackers. Event 1102 records which account cleared it. Because the event is written after clearing, forwarding logs to a SIEM is necessary to preserve the prior data.

Example

An administrator account clearing the security log on a domain controller at 3 a.m.

Exam tip

1102 is a high-priority alert and an indicator of log tampering.

Related terms