Security Log Integrity Compromised – 3 Real Fixes That Work

1. User or Service Clearing the Security Log Manually (Most Common)

I've seen this more times than I can count. A help desk guy tries to "clean up" the Event Viewer to free space, or an admin runs wevtutil cl security as a quick fix for a full log. The next thing you know, Event ID 1102 pops up: "The audit log was cleared." That's a dead giveaway that someone—or something—nuked the security log.

Here's the truth: Windows doesn't let you clear the security log without it being recorded. If you see Event ID 1102, the log was deliberately cleared. The question is: was it intentional or malicious?

How to Check Who Did It

Open Event Viewer. Go to Windows Logs > Security. Look for Event ID 1102. The details will show the user account that performed the clear. I had a client last month whose junior IT guy ran a script that cleared logs daily. The security team thought they were hacked. Nope, just poor training.

The Fix: Lock Down Who Can Clear Logs

1. Press Win + R, type secpol.msc, hit Enter.
2. Go to Security Settings > Local Policies > User Rights Assignment.
3. Find Clear security event log.
4. Remove all users and groups except Administrators and Event Log Readers (if needed).

This is basic stuff, but most small businesses don't bother. I've seen domain admins give everyone this right by accident. Don't be that shop.

Also, set a log retention policy so the log doesn't fill up. In secpol.msc, go to Event Log > Security. Set a max size (I recommend 1 GB for most small businesses) and choose "Overwrite events as needed." That way, the log never hits 100% and nobody gets tempted to clear it.

2. Disk Full or Log Corruption That Triggers a Log Clear

Another real-world mess: the security log fills up because someone set the max size too small or the disk runs out of space. When Windows can't write new events, it might behave oddly—sometimes it looks like the log was cleared, but really it just got corrupted and the system rebuilt it. You'll see Event ID 1104 next to 1102, which means "The security log is now full."

I had a client running a Windows Server 2016 box with a 128 MB security log. That thing filled up in two days. The log then corrupted, and the server auto-cleared it. The owner thought someone hacked them. Nope, just bad planning.

The Fix: Increase Log Size and Monitor Disk Space

1. Open Event Viewer.
2. Right-click Security under Windows Logs, choose Properties.
3. Set max log size to at least 1 GB (or 512 MB for smaller setups).
4. Check your system drive has at least 10% free space. If it's low, move the log folder to another drive.

To move the logs: change the registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Security and modify File to a new path (like D:\Logs\Security.evtx). Reboot. I've done this for clients with tiny C drives. Works fine.

Also set up a simple alert: use Task Scheduler to trigger when Event ID 1104 appears. Have it email you or pop up a warning. That way you know before the log gets corrupted again.

3. Antivirus or Security Software Interfering with Event Logging

This one's sneaky. Some security tools—especially older antivirus suites (looking at you, McAfee Endpoint Security 10.x)—mess with the Event Log service to "protect" it. They might stop the service, clear the log, or block writes. I saw this on a Windows 10 Pro machine last year. The client's antivirus kept clearing the security log every night at 2 AM. Event ID 1102 showed up, but the user account was SYSTEM. The antivirus was running as SYSTEM and clearing the log as part of its "maintenance."

How to Spot It

Check Event ID 1102. If the user is SYSTEM or NT AUTHORITY\SYSTEM, it's likely a system service or software, not a human. Look at the time—if it happens on a schedule, that's your clue.

The Fix: Change Antivirus Settings or Update

1. Open your security software's console.
2. Look for settings related to event log management, log cleanup, or system maintenance.
3. Disable any option that says "clear security log" or "reset event log."
4. Update the software to the latest version. Many vendors fixed this bug years ago.

If you can't find the setting, uninstall the software temporarily. Check if the log clearing stops. If it does, contact the vendor's support. I've had to do this for three different clients. One switched to a lighter antivirus because of this exact issue.

Also check third-party backup software. Some backup tools, like older versions of Acronis, would clear logs during the backup process. I've seen that once. Took me a week to figure out.

Quick-Reference Summary Table

Remember: if you see Event ID 1102 often, it's not always a hack. But it's always something you need to fix. Start with these three causes. I've yet to see a case that wasn't one of them.