Re: User Logoff not being recorded in Security Event Log

From: Eric Fitzgerald [MSFT] (ericf_at_online.microsoft.com)
Date: 07/15/03 

Date: Mon, 14 Jul 2003 17:24:56 -0700

Due to a specific class of bug in applications (not just in the OS) called a
"token leak", this sometimes occurs. In Windows 2003 we added a "begin
logoff" event to give something to correlate to in the absence of a logoff
event.

Eric 

-- 
Eric Fitzgerald
Program Manager, Windows Auditing
Microsoft Corporation
The above message is provided "AS-IS" with no warranties, and confers no
rights.
"George" <LogosSecure@AOL.COM> wrote in message
news:033c01c34a42$69e4dfd0$a301280a@phx.gbl...
> Greetings,
> Finding that after I have enabled success logging and
> failure logging for the Audit Logon Events, I am not
> receiving any logoff messages (Event 538, Type 2).  I am
> only logging the user logon messages (528, type2) but not
> the corresponding logoff messages.  Any recommendations on
> how to fix?

Relevant Pages

  • Re: Active Directory Audit logs
    ... Most logging of account related ... events (logon, logoff etc) is done on the default domain controllers OU so ...
    (microsoft.public.win2000.active_directory)
  • Re: Change password
    ... Maybe you can create a custom web part, that talks to the AD and change in ... but after changing I think you need the logoff again.. ... > I won't have them logging into a domain initially when ... > really so no direct domain login. ...
    (microsoft.public.sharepoint.portalserver)
  • Re: D3 Phantom Logoff/on nightly process
    ... doing a logoff from the phantom so that it can restart your nightly ... a phantom fails, compared to a logoff executed from a PIB which might ... Phantom has trouble logging it off remotely. ... LOGOFF {port} ...
    (comp.databases.pick)
  • User Logoff not being recorded in Security Event Log
    ... failure logging for the Audit Logon Events, ... receiving any logoff messages ...
    (microsoft.public.win2000.security)