Is it possible to delete some or all user session logon datetime records from Windows Vista? Is there any mechanism to give me confidence that individual records aren't deleted even if there isn't a public API call for that action?

  • Isn't it just a matter of hitting the delete button when viewing the logs.
    – Ramhound
    Commented Sep 17, 2012 at 14:09
  • 1
    @Ramhound I believe the log deletion in Windows (at least, via supported methods) is an all-or-nothing deal. You can delete the entire Security log, but not simply delete individual entries or just entries applying to a certain user or event type.
    – Iszi
    Commented Sep 17, 2012 at 14:51
  • 2
    IMO this question has nothing do with security. Nonetheless the simple answer is: you cant. Read this answer for more details.
    – a0viedo
    Commented Sep 18, 2012 at 15:07
  • @Iszi That's correct. When you clear the log, it deletes all entries, then adds an entry stating that you deleted the logs.
    – Polynomial
    Commented Sep 20, 2012 at 12:15
  • @Polynomial - So what is the problem? The author is willing to delete ALL of the logs in question.
    – Ramhound
    Commented Sep 24, 2012 at 12:52

2 Answers 2


You can clear an entire event log, but not individual entries.

If you're an administrator on the machine, you can go into Event Viewer and clear the Security log, by right clicking it and going into Properties, then clicking Clear Log. This will remove all logs, then add one entry that states the time and user ID that cleared the log.

Keep in mind that this may not necessarily destroy all traces of the security logs, since remnants of the login event may still exist in other event logs and log files. Furthermore, on systems that belong to a domain, the login logs may be stored on the active directory server as well as the local machine.

For example, the following logs usually contain duplicate evidence of logons, bootup events, or other activity that can be linked back to a username:

  • Applications and Services » Microsoft » Windows
    • TerminalServices-LocalSessionManager » Operational
    • PrintService » Admin
    • ReadyBoost » Operational
    • User Profile Service » Operational
    • Application-Experience » Program-Telemetry
    • Application-Experience » Program-Compatibility-Assistant
    • Diagnosis-Scheduled » Operational
    • Diagnosis-Scripted » Operational
    • Diagnosis-Scripted » Admin
  • Windows Logs » Application
    • Filter by User != SYSTEM and User != N/A, then order by time. Easy to spot events that correlate to specific times.

Technically it is not possible to delete single events within the EventLog. Atleast, I do not know of a publicly known API that does this within the EventLog call. There is a "Clear" method which removes all the entries, not just the specific ones.

All we can do is filter the logs.


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .