Clear All Event Logs in Event Viewer in Windows  

That makes sense an come to think of it it did slow down after a Mbam update....thanks for that heads up.

drugo said:

hi @Brink
this should work for Microsoft-Windows-LiveId , to clean the log
might you please check and confirm ?
cheers

Hey mate,

I'm not sure what you mean for it to work for Microsoft-Windows-LiveId.

The options in the tutorial work for both a local account and Microsoft account so long as it's an administrator.

drugo said:

hi
i tried to clean Microsoft-Windows-LiveId log , but i got always errors with all options in the first page ,option 1 ,2 ,3 and 4
i tried the bat above as administrator and it worked
but right now i guess some user posted in the here #39
have you tested the bat above?
thanks Brink

I've just tested it, but it failed to clear the Applications and Services logs > Microsoft > Windows > LiveId log for me even with Run as administrator.

Again, I wanted to delete all files in %windir%\System32\winevt\Logs\*.*
Naturally, Need firstly should be stopped netprofm & NlaSvc services, then the EventLog service. But sometimes netprofm & NlaSvc services can't stopped. Error: 1061.

I found a solution: Forced terminate of services. (Caution: Can cause unknown problems.)

Thanks Rishi in StackOverflow for the Powershell command trick.

Now, my final CleanEventViewerFiles.bat:

@echo off
net stop NcdAutoSetup /Y
net stop netprofm /Y
net stop NlaSvc /Y
net stop EventLog /Y


powershell -c "$ServicePID = (get-wmiobject win32_service | where { $_.name -eq 'NcdAutoSetup'}).processID; taskkill /f /pid $ServicePID"


powershell -c "$ServicePID = (get-wmiobject win32_service | where { $_.name -eq 'netprofm'}).processID; taskkill /f /pid $ServicePID"


powershell -c "$ServicePID = (get-wmiobject win32_service | where { $_.name -eq 'NlaSvc'}).processID; taskkill /f /pid $ServicePID"


powershell -c "$ServicePID = (get-wmiobject win32_service | where { $_.name -eq 'EventLog'}).processID; taskkill /f /pid $ServicePID"


ping 1.1.1.1 -n 1 -w 1500 > nul


del /f /q /a %windir%\System32\winevt\Logs\*.* >nul 2>nul
del /f /q /a %windir%\System32\WDI\LogFiles\*.* >nul 2>nul


net start NcdAutoSetup
net start netprofm
net start NlaSvc
net start EventLog

REM Recreating .EVTX files...
for /f %%a in ('WEVTUTIL EL') do WEVTUTIL CL "%%a" >nul 2>nul


pause

OldNavyGuy said:

I had to do the following in order to clear LiveId logs -

Code:

wevtutil sl Microsoft-Windows-LiveId/Operational /ca:O:BAG:SYD:(A;;0x1;;;SY)(A;;0x5;;;BA)(A;;0x1;;;LA)

wevtutil sl Microsoft-Windows-LiveId/Analytic /ca:O:BAG:SYD:(A;;0x1;;;SY)(A;;0x5;;;BA)(A;;0x1;;;LA)

Thank you.