Hi.
Have you set up the system to do auditing? Start\run type secpol.msc then
under local policies\audit policy, check security setting is set to either
success\failure\both (depending on what you want to audit.) A dual server
logo next to the audit policy is indicative that the policy comes from the
domain level.
How To View and Manage Event Logs in Event Viewer in Windows XP WGID:358
ID: 308427
How To Audit User Access of Files, Folders, and Printers in Windows XP
WGID:374
ID: 310399
If you have set it up and it is failing it may be a corrupted log. Have you
tried to open it on another machine? Does the number of secuirty events
list anything other than 0?
Cheers, Les
This posting is provided "AS IS" with no warranties, and confers no rights.
