Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 4 down vote favorite

Is it possible to delete some or all user session logon datetime records from Windows Vista? Is there any mechanism to give me confidence that individual records aren't deleted even if there isn't a public API call for that action?

share|improve this question
Isn't it just a matter of hitting the delete button when viewing the logs. – Ramhound Sep 17 '12 at 14:09
1  
@Ramhound I believe the log deletion in Windows (at least, via supported methods) is an all-or-nothing deal. You can delete the entire Security log, but not simply delete individual entries or just entries applying to a certain user or event type. – Iszi Sep 17 '12 at 14:51
2  
IMO this question has nothing do with security. Nonetheless the simple answer is: you cant. Read this answer for more details. – a0viedo Sep 18 '12 at 15:07
@Iszi That's correct. When you clear the log, it deletes all entries, then adds an entry stating that you deleted the logs. – Polynomial Sep 20 '12 at 12:15
@Polynomial - So what is the problem? The author is willing to delete ALL of the logs in question. – Ramhound Sep 24 '12 at 12:52
show 3 more comments

2 Answers

up vote 2 down vote

You can clear an entire event log, but not individual entries.

If you're an administrator on the machine, you can go into Event Viewer and clear the Security log, by right clicking it and going into Properties, then clicking Clear Log. This will remove all logs, then add one entry that states the time and user ID that cleared the log.

Keep in mind that this may not necessarily destroy all traces of the security logs, since remnants of the login event may still exist in other event logs and log files. Furthermore, on systems that belong to a domain, the login logs may be stored on the active directory server as well as the local machine.

For example, the following logs usually contain duplicate evidence of logons, bootup events, or other activity that can be linked back to a username:

  • Applications and Services » Microsoft » Windows
    • TerminalServices-LocalSessionManager » Operational
    • PrintService » Admin
    • ReadyBoost » Operational
    • User Profile Service » Operational
    • Application-Experience » Program-Telemetry
    • Application-Experience » Program-Compatibility-Assistant
    • Diagnosis-Scheduled » Operational
    • Diagnosis-Scripted » Operational
    • Diagnosis-Scripted » Admin
  • Windows Logs » Application
    • Filter by User != SYSTEM and User != N/A, then order by time. Easy to spot events that correlate to specific times.
share|improve this answer
up vote 1 down vote

Technically it is not possible to delete single events within the EventLog. Atleast, I do not know of a publicly known API that does this within the EventLog call. There is a "Clear" method which removes all the entries, not just the specific ones.

All we can do is filter the logs.

share|improve this answer
microsoft.com/resources/documentation/windows/xp/all/proddocs/… the microsoft provided the link how to delete eventlogs – vignesh4303 Sep 24 '12 at 13:03
@vignesh4303 Note that the link you provided shows how to delete all logs, not just one. It's still valid, but it's an important difference. – Polynomial Sep 25 '12 at 7:36

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.