RE: Event id 538 not being recorded

From: /.dz (dz_at_discussions.microsoft.com)
Date: 03/18/05

  • Next message: Jon Delano: "Re: allowing the asp.net account to access a share" 
    Date: Fri, 18 Mar 2005 13:21:12 -0800

    I'm no expert on this stuff, but there is a document that I stumbled across
    that may or may not shed some light on your situation.

    The document is a 'white paper' (meaning its an 'infomercial' by a s/w
    vendor) -- but I found the article well written and not at all obtrusive.
    The following URL gets you to the web page with a number of 'white papers'
    listed.

    http://www.eventlogmanager.com/support3.htm

    Maybe there's more than one white paper of interest to you, but the one that
    I thought might be relevant to your question is the one entitled 'Tracking
    User Activities in a Windows Environment' -- specifically pag.6, Paragraph
    2.3 .

    ./dz

    "vanguard" wrote:

    > Hi,
    >
    > I'm continuing to have the issue of event id 538 not showing up in the
    > security event log after the user logs out of the machine. I looked around
    > the KB base and found several articles,that didn't help my issue. I've
    > included pinging MS and they pointed me to a hotfix to download
    > (http://hotfixv4.microsoft.com/Windows%202000/sp5/PKG50859/2195/free/145921_ENU_i386_zip.exe).
    > This hotfix also failed to generate recordings of evt id 538. I've also
    > looked at the earlier exchange in this discussion group between Adam Sandler
    > and Torgeir Bakken (MVP) regarding (question about getting the user name of a
    > logoff event.) and was wondering if the script mentioned would generate event
    > id 538.
    >
    > Thanks
    >
    > -- Vanguard

  • Next message: Jon Delano: "Re: allowing the asp.net account to access a share"