Help with delayed logoff entry

I have a Windows XP Pro system with Service Pack 2, connected to a
Samba server (if that makes any difference). Auditing on the Windows
machine is turned on, and the security logs show two accounts with
logoff times long after their login times. This machine is in an
isolated network.

I am the only person with admin rights.

What might cause Windows XP w/SP2 to record a delayed logoff? I
searched for any file creation/modification dates for the date/time of
the logoff entry, but there was no hit.

The first Event ID is 551, followed by 538.

I have reviewed all the audit logs I could find, but on the Windows
system and the samba server, but no correlations anywhere.

Insights are welcome. I don't believe the system was hacked - I
just need to find out why/how Windows reported logoffs long after the
user logged in (one person's entry was about 12 hours after the fact,
and another person's entry, on the same computer, was a few days
later).

Neither person said they had any jobs running, but maybe Windows did
behind the scenes...???

Thanks.

Scott
.

Relevant Pages

  • Re: Stopping Windows File Protection
    ... MS-MVP Windows Shell/User ... >> 4 In the right pane, double-click Verbose vs normal status messages. ... >> 6 Close Group Policy Object Editor, click OK, and then quit Active ... >> Logon / Logoff status messages setting is turned on. ...
    (microsoft.public.windowsxp.general)
  • Re: login/logoff Report
    ... On the client PC I do see the logoff script run in the logoff window. ... also run gpupdate /force on the server and client. ... Server 2003, Windows XP Professional, or Windows 2000 ... Make sure the "logging folder" share has Share Permissions: ...
    (microsoft.public.windows.server.sbs)
  • Track Domain User Logons and Logoffs
    ... with logon/logoff events for all users within our windows ... Message: Successful Network Logon: ... EventCode: 540 ... Message: User Logoff: ...
    (microsoft.public.dotnet.framework.aspnet)
  • RE: Windows XP Automatic Log-off in SBS 2003 Domain
    ... The Logoff of the user will lead to lost data, ... Since those machines are shared, ... Windows 2000 Resource Kit provides a tool that you can use to ... Please follow the steps to configure the Winexit.scr Screen Saver: ...
    (microsoft.public.windows.server.sbs)
  • Re: Problems with logging off after upgrade to 2003 SP2
    ... You mention that users are unable to logoff. ... How to enable user environment debug logging in retail builds of Windows ... How to enable verbose startup, shutdown, logon, and logoff status ...
    (microsoft.public.windows.terminal_services)