Event ID 538

[Guest]

I have Windows 2000 Pro with SP3 Workstation that is a part of a Domain.

In that Workstation's "Local Security Policy" - "Security Settings" - "Local Policies", I enabled the following:
"Audit account logon events" to Success
"Audit logon events" to Success, Failure
"Audit system events" to Success.

When I LOCKED the workstation, the Security Event Viewer shows Event ID 538 indicating that my UserName has logoff.
However, if I actually LOGOFF OR RESTART that Workstation, the Security Event Viewer does NOT show Event ID 538.

The above issue also occurs even if I use Active Directory's Group Policy to set the "Local Policies".

Please help.

Sincerely,
Ibnu.

 

[Steven L Umbach]

The following KB link may be describing what you are experiencing. They ay it is by
design and suggest that you audit system events to see when a computer has been shut
down. I am not sure, but that may have been changed in SP4. --- Steve

http://support.microsoft.com/default.aspx?scid=kb;en-us;828857

I have Windows 2000 Pro with SP3 Workstation that is a part of a Domain.

In that Workstation's "Local Security Policy" - "Security Settings" - "Local

Policies", I enabled the following:

"Audit account logon events" to Success
"Audit logon events" to Success, Failure
"Audit system events" to Success.

When I LOCKED the workstation, the Security Event Viewer shows Event ID 538

indicating that my UserName has logoff.

However, if I actually LOGOFF OR RESTART that Workstation, the Security Event

Viewer does NOT show Event ID 538.

 

[Gary Mudgett [MSFT]]

There is also a hotfix documented in the following article that requires SP4
as a pre-requeset:
828020 User Logoff Event ID 538 Is Not Logged to the Security Event Log
http://support.microsoft.com/?id=828020

If you wanted the hotfix you would have to contact Microsoft to obtain it.

--
Gary Mudgett, MCSE, MCSA
Windows 2000/2003 Directory Services

=====================================================
When responding to posts, please "Reply to Group" via
your newsreader so that others may learn and benefit
from your issue.
=====================================================
This posting is provided "AS IS" with no warranties, and confers no rights.

 

[Guest]

Gary and Steven,

Thank you very, very much for the your insights.....
They are very helpful....