June 2009 - Posts

• ACS - How to collect event 1102 (Event Log Cleared) on Vista and later

  Event 1102 is logged to the security event log when the security event log is cleared. This event differs from most events in the security event log in that the event source is “Microsoft-Windows-Eventlog”, not “Microsoft-Windows-Security-Auditing”. By Read More... Posted Tuesday, June 30, 2009 6:17 PM by sampatton | 0 Comments