Security’s been erased.
Source of event
Microsoft-Windows-Eventlog — Security category.
Possible causes
- Voluntary maintenance
- Re-optimization of a system
- Attempt to hide traces
Verifications to be carried out
- Identify the account that made the action
- Check Centralized Newspapers
- Search for events prior to,efacement
Commands
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=1102} -MaxEvents 10Key takeaways
An Event ID must always be interpreted with its source, its full message, its timing and the context of the system. The same number may exist in several providers of events.