Event id 538 not being recorded

Archived from groups: microsoft.public.win2000.security (More info?)

I'm no expert on this stuff, but there is a document that I stumbled across
that may or may not shed some light on your situation.

The document is a 'white paper' (meaning its an 'infomercial' by a s/w
vendor) -- but I found the article well written and not at all obtrusive.
The following URL gets you to the web page with a number of 'white papers'
listed.

http://www.eventlogmanager.com/support3.htm

Maybe there's more than one white paper of interest to you, but the one that
I thought might be relevant to your question is the one entitled 'Tracking
User Activities in a Windows Environment' -- specifically pag.6, Paragraph
2.3 .

../dz

"vanguard" wrote:

> Hi,
>
> I'm continuing to have the issue of event id 538 not showing up in the
> security event log after the user logs out of the machine. I looked around
> the KB base and found several articles,that didn't help my issue. I've
> included pinging MS and they pointed me to a hotfix to download
> (http://hotfixv4.microsoft.com/Windows%202000/sp5/PKG508...).
> This hotfix also failed to generate recordings of evt id 538. I've also
> looked at the earlier exchange in this discussion group between Adam Sandler
> and Torgeir Bakken (MVP) regarding (question about getting the user name of a
> logoff event.) and was wondering if the script mentioned would generate event
> id 538.
>
> Thanks
>
> -- Vanguard