Is it possible to delete some or all user session logon datetime records from Windows Vista? Is there any mechanism to give me confidence that individual records aren't deleted even if there isn't a public API call for that action?
You can clear an entire event log, but not individual entries.
If you're an administrator on the machine, you can go into Event Viewer and clear the Security log, by right clicking it and going into Properties, then clicking Clear Log. This will remove all logs, then add one entry that states the time and user ID that cleared the log.
Keep in mind that this may not necessarily destroy all traces of the security logs, since remnants of the login event may still exist in other event logs and log files. Furthermore, on systems that belong to a domain, the login logs may be stored on the active directory server as well as the local machine.
For example, the following logs usually contain duplicate evidence of logons, bootup events, or other activity that can be linked back to a username:
- Applications and Services » Microsoft » Windows
- TerminalServices-LocalSessionManager » Operational
- PrintService » Admin
- ReadyBoost » Operational
- User Profile Service » Operational
- Application-Experience » Program-Telemetry
- Application-Experience » Program-Compatibility-Assistant
- Diagnosis-Scheduled » Operational
- Diagnosis-Scripted » Operational
- Diagnosis-Scripted » Admin
- Windows Logs » Application
- Filter by
User != SYSTEMand
User != N/A, then order by time. Easy to spot events that correlate to specific times.
- Filter by
Technically it is not possible to delete single events within the EventLog. Atleast, I do not know of a publicly known API that does this within the EventLog call. There is a "Clear" method which removes all the entries, not just the specific ones.
All we can do is filter the logs.