Event id 538 not being recorded

[Guest]

Hi,

I'm continuing to have the issue of event id 538 not showing up in the
security event log after the user logs out of the machine. I looked around
the KB base and found several articles,that didn't help my issue. I've
included pinging MS and they pointed me to a hotfix to download
(http://hotfixv4.microsoft.com/Windows 2000/sp5/PKG50859/2195/free/145921_ENU_i386_zip.exe).
This hotfix also failed to generate recordings of evt id 538. I've also
looked at the earlier exchange in this discussion group between Adam Sandler
and Torgeir Bakken (MVP) regarding (question about getting the user name of a
logoff event.) and was wondering if the script mentioned would generate event
id 538.

Thanks

-- Vanguard

 

[Guest]

I'm no expert on this stuff, but there is a document that I stumbled across
that may or may not shed some light on your situation.

The document is a 'white paper' (meaning its an 'infomercial' by a s/w
vendor) -- but I found the article well written and not at all obtrusive.
The following URL gets you to the web page with a number of 'white papers'
listed.

http://www.eventlogmanager.com/support3.htm

Maybe there's more than one white paper of interest to you, but the one that
I thought might be relevant to your question is the one entitled 'Tracking
User Activities in a Windows Environment' -- specifically pag.6, Paragraph
2.3 .

../dz