Missing event 538

[Guest]

I have a windows 2000 machnie (sp4 with all windows updates). I see the 528
event for when a user logs on but I'm not seeing a matching 538 for the
logoff. I have tried several hotfixes listed on various sites and still no
luck. Any suggestions?

 

[Steven L Umbach]

I am only aware of the info in the KB article below that requires you to
contact Microsoft for the hotfix. You probably have tried this already. The
only other thing I can suggest is to make sure you reboot the computer after
applying the hotfix and maybe trying to disable and then enable auditing of
logon events after a reboot. --- Steve

http://support.microsoft.com/default.aspx?scid=kb;en-us;828020

 

[Guest]

Steve,

Thanks for your suggestion, but yes that is one I applied and have reboot
several times since.

Thanks,

 

[Steven L Umbach]

OK. I can't think of much else. Hope someone can help you sort it out. ---
Steve