Event Viewer ID 104

By hensleycomputing ·
Hi has anyone ever seen this problem before
Offer the server windows 2008 R2 shutdown and restart event log was empty but the user says he did not clear the log
There is no automatic feature but the entire log was deleted.
Event Viewer ID 104

This conversation is currently closed to new comments.

Thread display: Collapse - | Expand +

All Answers

Collapse -

Some ideas...

by TobiF In reply to Event Viewer ID 104

Malware covering up its traces;
Electric outage blew the HDD sector where this file was located;
Logging of this event disabled...

Collapse -

Event source?

by seanferd In reply to Event Viewer ID 104

Any log text?

Regardless, I don't find any reference for this ID for 2k8 shutdown log. (Or is the ID simply describing "log cleared"?)

Whatever, who has access and permissions to the logs? You wouldn't have auditing turned on, would you? That would tell you whodunit.

Related Discussions

Related Forums