Tell me more ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.
up vote 1 down vote favorite

Can I disable logs and remove event id 1102 (=log cleared event)? I already tried:

Auditpol /set /category:* /success:disable

But that didn't work for event 1102!

share|improve this question
This sounds a bit suspicious. Why would you want to clear it? – pauska Aug 14 '12 at 12:13
Maybe you could ask the owner of the box to do it for you... – Dan Aug 14 '12 at 12:43
I own the box... – user900973 Aug 14 '12 at 12:48

closed as too localized by Chris S♦ Aug 16 '12 at 14:59

This question is unlikely to help any future visitors; it is only relevant to a small geographic area, a specific moment in time, or an extraordinarily narrow situation that is not generally applicable to the worldwide audience of the internet. For help making this question more broadly applicable, see the FAQ.

1 Answer

up vote 4 down vote

This event ID shows who cleared the security log so its a bit curious as to why you would want to clear it.

You should know the purpose of event logs is to show you things that you may or may not need to look into further. Microsoft goes out of their way to stop you from deleting pieces. This helps prevent people from mucking with your system and you having no knowledge at all. Which when people ask such a question, bad thoughts will be the first thing that comes to mind to anyone intelligent working in IT

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.