Event ID 538 not recorded for user logoffs.
From: Adam Sandler (corn29_at_excite.com)
Date: 03/18/05
- Next message: Mike Adams: "Certificate Server Web Server Template Please help"
- Previous message: Vanguard: "Re: Possible Email Attack Using Microsoft"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Date: 17 Mar 2005 15:50:50 -0800
Hello,
When looking at the Security log (W2K, SP4), I see the 528 event for
when a user logs on but I'm not seeing a matching 538 for the logoff.
I've double-checked the Local Security Policy | Local Policies | Audit
Policies | Audit Logon Events and both the effective setting and local
settings are set to Success and Failure.
In...
http://www.microsoft.com/technet/prodtechnol/windows2000serv/maintain/monitor/logonoff.mspx
...this is described as a bug but that isn't very helpful. Does anyone
know more as to why this is happening? Is there a fix? or is this
something I have to deal with?
Thanks!
- Next message: Mike Adams: "Certificate Server Web Server Template Please help"
- Previous message: Vanguard: "Re: Possible Email Attack Using Microsoft"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Relevant Pages
|
