Skip to content
EVTX parser

Event ID 104: Log was cleared (System) (System)

What this Event ID actually records on disk, the EventData fields worth reading first, and where it sits in a DFIR triage workflow.

Channel
System
Provider
Windows\System
Triage notes
Service Control Manager's counterpart to Security 1102. Often missed by attackers who only clear Security.

Microsoft Learn

https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/manage/component-updates/wineventOpen the official reference ↗

Related Event IDs