R
robert.macnutt
Does anyone know the difference between Event ID 538 (User Logoff), and
Event ID 551 (User initiated logoff)?
As far as I can tell, the 'normal" sequence of things is 528 (logon),
538, then 551. But I see a lot of instances of just 528 then 538, and
I suspect these are instances where my users claim they're just being
knocked off the server. Also, I see a lot of 538's all by themselves -
I see a 528, then 538 and 551, then some time later (maybe hours),
there's a 538, then another 538 (these are all events for the same
userid). It's almost as if the system is logging the user off when
they're not even logged on.
This is Windows Server 2000 with Citrix Metaframe XP
Event ID 551 (User initiated logoff)?
As far as I can tell, the 'normal" sequence of things is 528 (logon),
538, then 551. But I see a lot of instances of just 528 then 538, and
I suspect these are instances where my users claim they're just being
knocked off the server. Also, I see a lot of 538's all by themselves -
I see a 528, then 538 and 551, then some time later (maybe hours),
there's a 538, then another 538 (these are all events for the same
userid). It's almost as if the system is logging the user off when
they're not even logged on.
This is Windows Server 2000 with Citrix Metaframe XP