538 events not logged on Win2K Pro

Greetings. I am setting up stand alone workstations for a secure government area. There is a security requirement for these systems to log an event code 538 upon user logoff. To date, I have applied two seperate Microsoft hot fixes, neither of which resolved the issue. My question is, is there any way to force this event to log. Keep in mind that the audit policies have already been configured to log this event type.