Logoff Events do not get logged...Why?

[Jim Nugent]

On a standalone Win2000 workstation, I have "Audit Logon Events" enabled. I
get Event log entries for User Logons (Event 528) but almost never see
Logoff Events (event 538). Does anyone know why this could happen? Is there
another setting I'm missing?

 

[Gary Mudgett [MSFT]]

The following article has an update that would need to be applied to the
machine. In order to get the update you would need to call Microsoft.
828020 User Logoff Event ID 538 Is Not Logged to the Security Event Log
http://support.microsoft.com/?id=828020

--
Gary Mudgett, MCSE, MCSA
Windows 2000/2003 Directory Services

=====================================================
When responding to posts, please "Reply to Group" via
your newsreader so that others may learn and benefit
from your issue.
=====================================================
This posting is provided "AS IS" with no warranties, and confers no rights.

 

[Jim Nugent]

The following article has an update that would need to be applied to the
machine. In order to get the update you would need to call Microsoft.
828020 User Logoff Event ID 538 Is Not Logged to the Security Event Log
http://support.microsoft.com/?id=828020

Thank you for the info. This article describes my problem exactly.
Unfortunately, I have an OEM version of Win 2k and Microsoft Support won't
touch it without charging an arm and a leg. My Value Added Reseller who sold
me the system doesn't have a clue what I am talking about. (Are there any
requirements that an "OEM" has to meet as to being ABLE TO SUPPORT Windows
before they can resell the OEM version?)

All I believe I need (per KB 828020) is
1. a copy of win32k.sys version .0.2195.6825
2. A way to get Windows File Protection to "adopt" it.

Seems simple enough. Any ideas?

 

[Jim Nugent]

1. a copy of win32k.sys version .0.2195.6825

Ooops.... make that version 5.0.2195.6825

 

[Gary Mudgett [MSFT]]

The best way would be to request the hotfix. Hotfixes can be provided free
of charge. It shouldn't matter if it is OEM or not. The other option would
be waiting until the next service pack is released.

--
Gary Mudgett, MCSE, MCSA
Windows 2000/2003 Directory Services

=====================================================
When responding to posts, please "Reply to Group" via
your newsreader so that others may learn and benefit
from your issue.
=====================================================
This posting is provided "AS IS" with no warranties, and confers no rights.