Event id 538 not being recorded

From: vanguard (vanguard_at_discussions.microsoft.com)
Date: 03/15/05 

Date: Mon, 14 Mar 2005 15:11:06 -0800

Hi,

I'm continuing to have the issue of event id 538 not showing up in the
security event log after the user logs out of the machine. I looked around
the KB base and found several articles,that didn't help my issue. I've
included pinging MS and they pointed me to a hotfix to download
(http://hotfixv4.microsoft.com/Windows%202000/sp5/PKG50859/2195/free/145921_ENU_i386_zip.exe).
This hotfix also failed to generate recordings of evt id 538. I've also
looked at the earlier exchange in this discussion group between Adam Sandler
and Torgeir Bakken (MVP) regarding (question about getting the user name of a
logoff event.) and was wondering if the script mentioned would generate event
id 538.

Thanks

-- Vanguard

Relevant Pages

  • Re: Keeping Track of Use
    ... > amount of time a user logs off and on. ... Go into Administrative Tools, Local Security Policy. ... You can 'dump' the security event log ... column format for tallying, reporting, whatever. ...
    (microsoft.public.windowsxp.basics)
  • Re: inoperative terminal services
    ... There's both a hotfix and a workaround: ... 891577 - A Terminal Services session to a Windows 2000-based ... computer stops responding if a user logs off after the user quits a ...
    (microsoft.public.win2000.termserv.clients)