Your Security Logs Are Broken: Fix Integrity Alerts Fast

Start Here: 30-Second Fix – Check the Event Viewer

First, do not panic. This error doesn't always mean you've been hacked. It often happens after a forced shutdown, a disk error, or a failed Windows update. I had a client last month whose whole log broke after a power outage. Here's what to do right now:

1. Open Event Viewer (press Win + R, type eventvwr.msc, hit Enter).
2. Go to Windows Logs > Security.
3. Look for Event ID 1102 or 4612. These are the ones that say "Security log integrity is compromised."
4. Check the time stamp. If it's recent, note it. If it's old (like a week ago), it might be a leftover warning that you can ignore after fixing.

If you see a bunch of these events in a row, skip to the moderate fix below. But sometimes all you need is to clear the log and move on.

Quick test: Right-click Security log, choose Clear Log. If it clears without error, you're probably fine. If it says "Access Denied" or "The handle is invalid," keep reading.

Moderate Fix (5 Minutes): Reset Permissions on the Log File

Windows stores security logs in a file called Security.evtx. If the permissions get messed up, Event Viewer can't write or read it correctly. Here's how to fix that:

1. Open Command Prompt as Administrator (press Win + X, choose Terminal (Admin) or Command Prompt (Admin)).
2. Type this command and press Enter:
   

   icacls %SystemRoot%\System32\winevt\Logs\Security.evtx /grant "SYSTEM":(F) "Administrators":(F)

3. That forces full control for SYSTEM and Administrators. If it gives you an error like "The file is in use," you need to stop the Windows Event Log service first.
4. Stop the service:

   net stop EventLog

5. Then run the icacls command again.
6. Restart the service:

   net start EventLog

Why this works: When the log file permissions get corrupted (happens after a bad update or restore from backup), Event Viewer sees the file as untrustworthy and flags the integrity error. Resetting permissions fixes that.

If you still see the error after this, move to the advanced fix.

Advanced Fix (15+ Minutes): Check for Malware and Repair the Log

If the first two fixes didn't work, something is actively messing with your logs. Could be malware, could be a disk problem, could be a rogue driver. Here's the step-by-step:

1. Run a Full Malware Scan

Do not use Windows Defender alone for this. Grab something like Malwarebytes (free version works) and run a scan. Also run Kaspersky Virus Removal Tool or Emsisoft Emergency Kit. I've seen rootkits that specifically target event logs to hide their tracks.

Had a client last week whose security log kept flipping to "integrity compromised" – turned out someone installed a crypto miner that was deleting log entries. The miner was hiding in the Temp folder. Malwarebytes caught it.

2. Check Disk for Errors

A corrupt hard drive can mess up any file, including the security log. Run this in an admin command prompt:

chkdsk C: /f /r

It'll ask you to schedule a check on next reboot. Type Y and reboot. Let it run – can take 30-60 minutes. If it finds bad sectors, replace the disk soon.

3. Reset the Security Log Completely

If the log is beyond repair, delete it and let Windows create a fresh one. Do NOT just delete the file – you'll lose all historical log entries. But if you're getting integrity errors, they're probably already corrupted anyway.

1. Stop the Event Log service again: net stop EventLog
2. Rename the old file (as backup): ren C:\Windows\System32\winevt\Logs\Security.evtx Security_old.evtx
3. Restart the service: net start EventLog

Windows will create a fresh Security.evtx file automatically. Check Event Viewer – the integrity error should be gone.

4. Enable Audit Logging Again (If Needed)

Sometimes the error happens because audit policies get disabled. Open an admin command prompt and run:

auditpol /set /subcategory:"Security System Extension" /success:enable /failure:enable

Then check your policies: auditpol /get /category:*. Make sure critical categories like Logon, Account Management, and Privilege Use are enabled for success and failure.

When to Call for Professional Help

If after all this you still see Event ID 1102 every few minutes, you likely have a persistent threat that's actively deleting logs. Hire a professional incident response team (or at least run a deeper scan with Sysinternals Autoruns and Process Explorer). Don't ignore this – a compromised security log gives attackers free reign to do anything without leaving traces.

Last thing: if you're in a regulated industry (HIPAA, PCI, etc.), this error might need to be reported. Check your compliance requirements.