There is no standard methods for accomplishing a selective erase in Windows NT 4.0 or Windows 2000.
I quote excepts from various documents:
What is WinZapper?
WinZapper is a tool with which you can erase event records selectively from the Security Log in Windows NT 4.0 and Windows 2000.
How do I use this tool?
Download the zip file and extract the files in it. Run winzapper.exe and mark the event records to be deleted, then press "Delete events and Exit". Next, reboot Windows to re-enable the event logging system. (You can't use the Event Viewer again before rebooting.)
Which OS's are supported?
Windows NT 4.0 and Windows 2000.
What if there is a problem?
Then check out the WinZapper FAQ. http://ntsecurity.nu/toolbox/winzapper/faq.shtml.
There is a small risk that this program corrupts the event logs so they must be cleared completely.
This is an announcement of a new tool - WinZapper - for Windows NT 4.0 and Windows 2000, that can be used to selectively erase event log records in the security log. As far as we know there exist no other tool that is able to do this. WinZapper can be downloaded from: http://ntsecurity.nu/toolbox/winzapper/ Further than only announcing this tool we would like to emphasize a few important things: * WinZapper can only be used from an Administrators account, thus this has _nothing_ to do with any new security vulnerabilities in Windows NT / 2000. Please refrain from bashing MS about this! * There seems to be a common misconception out there that there is no way to erase individual event records in the security log. (The ordinary API to the event logging system only allows clearing the whole log, and the log files are locked by the OS.) This is not true, and now we have been able to show this in practice. * There seems to be another common misconception out there that there is no way to write "fake" event records into the security log. This is not true either - any user with an Administrators account can inject completely made up event records into the security log. Please remember this before using the log to point out offenders! * It would be trivial to extend WinZapper to work remotely like a client/server system. Thus, this is _not_ limited to attackers having physical access! To sum things up: after an attacker has gained Administrators access to your system, you simply cannot trust your security log! And as always, remember that attacker having that kind of access can do _anything_ to your system! Regards, Arne Vidstrom / The ntsecurity.nu team. http://ntsecurity.nu - providing unique freeware security tools for Windows NT 4.0 / 2000