RE: Event id 538 not being recorded
From: /.dz (dz_at_discussions.microsoft.com)
Date: Fri, 18 Mar 2005 13:21:12 -0800
I'm no expert on this stuff, but there is a document that I stumbled across
that may or may not shed some light on your situation.
The document is a 'white paper' (meaning its an 'infomercial' by a s/w
vendor) -- but I found the article well written and not at all obtrusive.
The following URL gets you to the web page with a number of 'white papers'
Maybe there's more than one white paper of interest to you, but the one that
I thought might be relevant to your question is the one entitled 'Tracking
User Activities in a Windows Environment' -- specifically pag.6, Paragraph
> I'm continuing to have the issue of event id 538 not showing up in the
> security event log after the user logs out of the machine. I looked around
> the KB base and found several articles,that didn't help my issue. I've
> included pinging MS and they pointed me to a hotfix to download
> This hotfix also failed to generate recordings of evt id 538. I've also
> looked at the earlier exchange in this discussion group between Adam Sandler
> and Torgeir Bakken (MVP) regarding (question about getting the user name of a
> logoff event.) and was wondering if the script mentioned would generate event
> id 538.
> -- Vanguard