On a university Windows host, event 1102 reports that the security audit log was cleared outside any maintenance window the team expected. Why does that event matter?
Select an answer to reveal the explanation.
Short Explanation
Shredding the sign-in book is not the same as locking the door for the night. Event 1102 means someone cleared the local security audit log, and you treat that act as a lead. A clean reboot, a successful logon, and a Kerberos ticket are different events.
Full Explanation
Event 1102 means the audit log was cleared, so local security history that investigators would have read is gone, and the clear itself is evidence of that removal. Someone cleared the local security audit log, and that clearing is itself a lead, is why the event matters even before any other host fact is known. A clean reboot of the host, with the security log rolling over as part of a normal restart, is a different story; 1102 is a clear, not a boot. A successful logon, the event recorded when authentication to the host succeeds, is event 4624, not a cleared log. A Kerberos ticket-granting ticket request, recorded when the account asks for a TGT, is event 4768 and does not erase the audit log. Clearing the log removes local history investigators would use for the period before the clear, so the event is a lead on its own. Exam caveat: an authorized maintenance clear can also write 1102, so an unexpected clear stays a lead until a change ticket explains it. Operational check: align the 1102 time with university change tickets and note the gap it leaves in the security log on that host.