# Windows event IDs - 104 - [[Windows event logs|Event log]] was cleared - [1102](https://support.alertlogic.com/hc/en-us/articles/115004121423-Windows-Security-Event-Log-Cleared) - Audit log was cleared ([517](https://serverfault.com/questions/743575/how-to-find-out-who-deleted-event-viewer-logs/743577#743577) on Windows 2003 and earlier) - 4104 - PowerShell command and script logging - 4626 - Successful logon - LogonType 3 represents a (generic) network login - LogonType 9 represents a logon where the outbound credentials are different than the credentials used to authenticate to the account that is initiating that login (only logged by the host *initiating* the connection, however) It's hard to find documentation about event ID, and the meaning seems to shift between versions of Windows.