XP not capturing logoff events

[Andrew Nightingale]

I have a standalone PC running XP Pro, and cannot get any
of the logoff events (538) to show up in the security log.
Odd, as every other audit setting, including
successful/failed logons, is being captured correctly. Any
insight would be greatly appreciated.

 

[Ben [MSFT]]

Andrew,

Two things to check:
1. Make sure that "Audit account logon events" is enabled for success
auditing.
2. Ensure that the Security event log is not full. If so you can either
backup and clear the logs or select it to "Overwrite as needed".

blim
This posting is provided "AS IS" with no warranties, and confers no rights.
--------------------
| >Content-Class: urn:content-classes:message
| >From: "Andrew Nightingale" <[email protected]>
| >Sender: "Andrew Nightingale" <[email protected]>
| >Subject: XP not capturing logoff events
| >Date: Tue, 16 Dec 2003 03:31:25 -0800
| >Lines: 5
| >Message-ID: <[email protected]>
| >MIME-Version: 1.0
| >Content-Type: text/plain;
| > charset="iso-8859-1"
| >Content-Transfer-Encoding: 7bit
| >X-Newsreader: Microsoft CDO for Windows 2000
| >Thread-Index: AcPDyCNjoNqAdnpKTcClC/xSSRttyg==
| >X-MimeOLE: Produced By Microsoft MimeOLE V5.50.4910.0300
| >Newsgroups: microsoft.public.windowsxp.security_admin
| >Path: cpmsftngxa07.phx.gbl
| >Xref: cpmsftngxa07.phx.gbl
microsoft.public.windowsxp.security_admin:102572
| >NNTP-Posting-Host: tk2msftngxs01.phx.gbl 10.40.2.125
| >X-Tomcat-NG: microsoft.public.windowsxp.security_admin
| >
| >I have a standalone PC running XP Pro, and cannot get any
| >of the logoff events (538) to show up in the security log.
| >Odd, as every other audit setting, including
| >successful/failed logons, is being captured correctly. Any
| >insight would be greatly appreciated.
| >