Log Dejargonizer

Windows System Log · Event 104

Event 104: An event log was cleared

Someone cleared a log other than Security — the System log, the Application log, or an operational channel. It is the counterpart to Event 1102 and carries the same meaning: whatever was in that log is gone, and someone chose to remove it.

Also written as 104Event ID 104The System log file was clearedevent log cleared 104

What it means for you

On a personal computer

A record of activity on this PC was deleted. People sometimes do this to clean up Event Viewer, but if you did not, it is worth understanding who did.

For an analyst

Watch this alongside 1102. Attackers who know 1102 is monitored sometimes clear the operational channels instead — Sysmon, PowerShell, Terminal Services — which is where the actual evidence often lives. The message names which log was cleared, and that name is the interesting part.

What it looks like

Sanitised. Addresses come from the RFC 5737 documentation ranges.

Sample
The Microsoft-Windows-Sysmon/Operational log file was cleared.

The fields that decide it

Everything else in the log line is context.

Channel
Which log was cleared. Sysmon, PowerShell, and Terminal Services operational channels are more telling targets than the System log.
  • SystemOften cleared during genuine troubleshooting.
  • Microsoft-Windows-Sysmon/OperationalAlmost never cleared legitimately. Detection evidence lives here.
  • Microsoft-Windows-PowerShell/OperationalWhere script block logging lives. Clearing it is a strong signal.
  • Microsoft-Windows-TerminalServices-LocalSessionManager/OperationalRemote Desktop session history.
SubjectUserName
The account that cleared it.
Backup
Whether the log was saved to a file before being cleared, which distinguishes an archive from a wipe.

Ordinary reasons this happens

Most of the time it is one of these.

  • An administrator clearing the System or Application log while troubleshooting.
  • A machine being rebuilt or decommissioned.
  • Archiving tools that export and then clear a log, which should be a documented behaviour.
  • Clearing a log deliberately to watch a problem reproduce cleanly.

When it is not ordinary

Destroying evidence in the operational channels.

What gives it awayA clear of the Sysmon, PowerShell, or Terminal Services log with no matching change record.

ATT&CK T1070.001

Covering tracks while avoiding a monitored event.

What gives it awayClearing logs other than Security, on the assumption that only 1102 is alerted on.

ATT&CK T1070.001

What to do next

  1. Read which channel was cleared. Sysmon and PowerShell operational logs are far more telling than the System log.
  2. Retrieve the forwarded copy from your collection platform — that is the actual investigation.
  3. Identify the account and confirm whether the clear was deliberate.
  4. Check whether 1102 also fired around the same time.
  5. Check other machines for clears in the same window.

Queries to run

powershell 
Get-WinEvent -FilterHashtable @{LogName='System'; Id=104} -MaxEvents 20 | Select-Object TimeCreated, Message | Format-List
kql Should be empty in a healthy environment. Alert on it alongside 1102. 
Event | where EventID == 104 | project TimeGenerated, Computer, RenderedDescription | order by TimeGenerated desc

Common questions

What is the difference between Event 104 and Event 1102?

1102 is written when the Security log specifically is cleared. 104 covers every other log — System, Application, and the operational channels such as Sysmon and PowerShell. Both mean evidence was destroyed, and monitoring only 1102 leaves an obvious gap.

Is Event 104 something to worry about?

It depends on which log was cleared. The System log being cleared during troubleshooting is ordinary. The Sysmon or PowerShell operational log being cleared is not — those hold detection evidence and there is very little legitimate reason to wipe them.

Read next

Mentioned by

Vendor documentation

Last reviewed 28 August 2026