Audit Trails - Win2K

  • Thread starter Thread starter R. R.
  • Start date Start date
R

R. R.

In windows 2K, the audit code for a log off is 539.
However, these is an issue and we were told to use 2x 578
as a log off. Once we updated to service pack 3, we lost
all forms of tracking a log off. How can we fix this
issue?
 
If auditing of logon events is enabled, logoffs show as Event ID 538 in the security
log. --Steve
 
Back
Top