Event ID 538

  • Thread starter Thread starter Guest
  • Start date Start date
G

Guest

I have Windows 2000 Pro with SP3 Workstation that is a part of a Domain.

In that Workstation's "Local Security Policy" - "Security Settings" - "Local Policies", I enabled the following:
"Audit account logon events" to Success
"Audit logon events" to Success, Failure
"Audit system events" to Success.

When I LOCKED the workstation, the Security Event Viewer shows Event ID 538 indicating that my UserName has logoff.
However, if I actually LOGOFF OR RESTART that Workstation, the Security Event Viewer does NOT show Event ID 538.

The above issue also occurs even if I use Active Directory's Group Policy to set the "Local Policies".

Please help.

Sincerely,
Ibnu.
 
The following KB link may be describing what you are experiencing. They ay it is by
design and suggest that you audit system events to see when a computer has been shut
down. I am not sure, but that may have been changed in SP4. --- Steve

http://support.microsoft.com/default.aspx?scid=kb;en-us;828857

ibnu said:
I have Windows 2000 Pro with SP3 Workstation that is a part of a Domain.

In that Workstation's "Local Security Policy" - "Security Settings" - "Local
Click to expand...
Policies", I enabled the following:
"Audit account logon events" to Success
"Audit logon events" to Success, Failure
"Audit system events" to Success.

When I LOCKED the workstation, the Security Event Viewer shows Event ID 538
Click to expand...
indicating that my UserName has logoff.
However, if I actually LOGOFF OR RESTART that Workstation, the Security Event
Click to expand...
Viewer does NOT show Event ID 538.
 
There is also a hotfix documented in the following article that requires SP4
as a pre-requeset:
828020 User Logoff Event ID 538 Is Not Logged to the Security Event Log
http://support.microsoft.com/?id=828020

If you wanted the hotfix you would have to contact Microsoft to obtain it.

--
Gary Mudgett, MCSE, MCSA
Windows 2000/2003 Directory Services

=====================================================
When responding to posts, please "Reply to Group" via
your newsreader so that others may learn and benefit
from your issue.
=====================================================
This posting is provided "AS IS" with no warranties, and confers no rights.
 
Gary and Steven,

Thank you very, very much for the your insights.....
They are very helpful....
 
Back
Top