Clear Windows Event Logs

Clear a selected Windows event log on a remote host through the EventLog Remoting Protocol (MS-EVEN). The protocol uses authenticated RPC over SMB to its eventlog named-pipe endpoint; the account must be authorized to clear the selected log by its event-log access control. This operation removes records used for investigation. Windows records a clear event for the Security log (Event ID 1102) and for other cleared logs (Event ID 104 in the System channel), subject to normal log collection and retention.