Under Windows 7 you open the Event Viewer to browse several categories. You can also clear a single category by clicking Clear Log... on the right pane.

Assuming I want to clear ALL categories, am I supposed to click and clear them one by one?
There are dozens of them. Is there a faster way? Maybe with PowerShell?

enter image description here enter image description here

6 Answers 6


Try WEvtUtil.exe

There's no way via the GUI to clear all logs at once. At least not that I've ever found. :)

Loop and delete with intermediate file

Here's a batch file that uses WEVTUTIL.exe to list the logs into a text file, and then use that text file to delete each of the logs.

for /f %%a in ( .\LOGLIST.TXT ) do WEVTUTIL CL "%%a"
timeout 30

If you feel unsafe having this all in one batch file, then you can save this to two separate files and then run one after the other:
(The "Nuke" batch will just error out if it doesn't find a "loglist.txt" in its current directory.)


REM Source: https://superuser.com/a/655185/389368
WEvtUtil.exe enum-logs > .\LOGLIST.TXT


REM Source: https://superuser.com/a/655185/389368
for /f %%a in ( .\LOGLIST.TXT ) do WEvtUtil.exe clear-log "%%a"
timeout 30

Loop and delete directly

As Logman pointed out in his answer, this can be further shortened down (and eliminate the need for the intermediate text file) by using something like (%'s double for batch file):

for /f %%a in ('WEVTUTIL EL') do WEVTUTIL CL "%%a"
timeout 30

Run as Admin!

Whichever way you choose, ensure you "Run As Administrator".

Easiest solution I've found. Been using it since Vista. :)

  • I was considering using WMI in a python script or similar - very good example of how batch can be an easier solution in certain scenarios.
    – Lyle Brown
    Oct 6, 2013 at 18:50
  • CMD output + Event viewer overview. Used your second example via batch as admin. Some categories can't be cleared? Strange. And Powershell categorie still has 11.511 events? All others seem to be cleared
    – nixda
    Oct 6, 2013 at 19:04
  • Screwed by a lack of quotes. sorry about that, fixed it. :) Oct 6, 2013 at 19:08
  • Is it possible to use this solution or the proposed by @Logman in Windows XP? I don't see it has wevtutil in the system. Apr 22, 2014 at 10:39
  • 1
    @SopalajodeArrierez "wevtutil" is only available from Vista and above... technet.microsoft.com/en-us/library/cc732848.aspx
    – Logman
    Apr 22, 2014 at 12:50

Open cmd prompt or create batch script and "run as admin":

for /f %x in ('wevtutil el') do wevtutil cl "%x"

Powershell code for clearing all event logs:

wevtutil el | Foreach-Object {Write-Host "Clearing $_"; wevtutil cl "$_"}

or pick and choose in a script:

wevtutil.exe cl Analytic
wevtutil.exe cl Application
wevtutil.exe cl DirectShowFilterGraph
wevtutil.exe cl DirectShowPluginControl
wevtutil.exe cl EndpointMapper
wevtutil.exe cl ForwardedEvents
wevtutil.exe cl HardwareEvents
wevtutil.exe cl Internet Explorer
wevtutil.exe cl Key Management Service
wevtutil.exe cl MF_MediaFoundationDeviceProxy
wevtutil.exe cl "Media Center"
wevtutil.exe cl MediaFoundationDeviceProxy
wevtutil.exe cl MediaFoundationPerformance
wevtutil.exe cl MediaFoundationPipeline
wevtutil.exe cl MediaFoundationPlatform
wevtutil.exe cl Microsoft-IE/Diagnostic
wevtutil.exe cl Microsoft-IEFRAME/Diagnostic
wevtutil.exe cl Microsoft-PerfTrack-IEFRAME/Diagnostic
wevtutil.exe cl Microsoft-PerfTrack-MSHTML/Diagnostic


You can get a complete list of all event category names by typing the following in a cmd prompt or powershell:

wevtutil el

More information can be found at MS TechNet. Examples:

Export events from System log to C:\backup\system0506.evtx:

wevtutil epl System C:\backup\system0506.evtx

Clear all of the events from the Application log after saving them to C:\admin\backups\a10306.evtx:

wevtutil cl Application /bu:C:\admin\backups\a10306.evtx
  • wevtutil is quite slow, specially when you clear all logs (including empty ones)

  • fastest solution I came up with:

ForEach ( $l in ( Get-WinEvent * ).LogName | sort | get-unique ) {[System.Diagnostics.Eventing.Reader.EventLogSession]::GlobalSession.ClearLog("$l")}

Resul: "Cleared 16 events in 4 logs: 0.3684785 seconds"

Each part:

  • only gets logs containing events (there will be duplicate LogNames)

    ForEach ( $l in ( Get-WinEvent * ).LogName | sort | get-unique )

  • clear each one

    System.Diagnostics.Eventing.Reader.EventLogSession]::GlobalSession.ClearLog( "$l" )

Full function:

function Clear-EventLogs
        $t1          = ( Measure-Command -Expression{ $active = ( Get-WinEvent ).LogName } ).TotalSeconds
        $totalEvents = $active.Count
        $active      = $active | Sort | Get-Unique
        $totalLogs   = $active.Count
        $t2 = ( Measure-Command -Expression{
            ForEach ( $l in $active )
                [System.Diagnostics.Eventing.Reader.EventLogSession]::GlobalSession.ClearLog( "$l" )
                # ForEach-Object { Wevtutil.exe cl "$l" }
        } ).TotalSeconds
    End     { $t3 = $t1 + $t2; Write-Output "Cleared $totalEvents events in $totalLogs logs: $t3 seconds" }

If you see "Get-WinEvent : The data is invalid", you've hit the undocumented hard-limit of 256 logs. It may be necessary to filter the logs first. The following will select only the logs that have events (credit to http://www.powershellish.com/blog/2015/01/19/get-winevent-max-logs/ for the diagnosis ):

$logs = Get-WinEvent -ListLog * | Where-Object {$_.RecordCount} | Select-Object -ExpandProperty LogName
ForEach ( $l in ( Get-WinEvent $logs ).LogName | sort | get-unique ) {[System.Diagnostics.Eventing.Reader.EventLogSession]::GlobalSession.ClearLog("$l")}
  • 2
    I retested this function. It took 271 seconds to wipe 168802 events
    – nixda
    Aug 27, 2015 at 17:10
  • 1
    @nixda: 5 minutes for 169,000 events is not very fast, but I'm not sure how wevtutil would performs with the same number of events (it may also skip some of them)
    – paul bica
    Aug 27, 2015 at 19:44
  • Changing your original command from Get-WinEvent * to Get-WinEvent -ListLog * seems to be sufficient to resolve the "The Data is invalid" error spam and clear the logs. It took about a second to clear all the logs on my system though I did get a "Exception calling ClearLog with 1 argument: Attempted to perform an unauthorized operation" error. So hopefully I didn't break anything 🤷‍♂️ Oct 8, 2020 at 16:30

It is important to use the delim option if you have spaces in the names:

for /f "delims=" %%a in ( .\LOGLIST.TXT ) do WEVTUTIL CL "%%a"

You can also easily disable all event logging without stopping the event log service:

for /f "delims=" %%a in ('WEVTUTIL EL') do WEVTUTIL SL "%%a" /e:false

Of course this will only disable actually installed software events, if you install a new software, it will have the logging enabled by default. But good thing you can leave the Task Scheduler running, so just do it every month ;-)

  • How can I revert your second command (with SL and /e:false)? Or how can I restore all my event log properties back to default?
    – PeterCo
    May 31, 2016 at 9:28
  • Dear PeterCo. I am not sure, what you mean by default. Check the documentation for the WEVTUTIL command, e.g. try to enter WEVTUTIL sl /? at a command line. Sep 1, 2016 at 21:53

BTW, this clears all the Log files, which can (depending on previous settings) free up quite some space

for /f "delims=" %%a in ( .\LOGLIST.TXT ) do WEVTUTIL CL "%%a"
timeout 10

I've used .bat files to make it a little bit easier to clear log files. Just picked the simple script here http://winaero.com/blog/how-to-clear-the-windows-event-log-from-the-command-line/

Copied from that link.

@echo off
FOR /F "tokens=1,2*" %%V IN ('bcdedit') DO SET adminTest=%%V
IF (%adminTest%)==(Access) goto noAdmin
for /F "tokens=*" %%G in ('wevtutil.exe el') DO (call :do_clear "%%G")
echo Event Logs have been cleared!
goto theEnd
echo clearing %1
wevtutil.exe cl %1
goto :eof
echo You must run this script as an Administrator!
  1. Open Notepad and copy-paste the that text into it.

  2. Save it as a batch file and give it any name you want for example: ClEvtLog.bat or ClEvtLog.cmd.

  3. Run it with admin rights.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.