Windows 2K Auditing Error

Are the security settings - set up to audit the system events?

Events 528 and 538 record logon/logoff
Also check your policy setting for auditing both success/failure.

Although these events may be identical at the summary level in the Security Log, the details screen makes some distinctions among them.

Here are the Event IDs and type designations for the most common log on and log off events:

Interactive logon Event ID 528 Type 2
Interactive logoff Event ID 538 Type 2
Network logon Event ID 528 Type 3
Net Use connection Event ID 528 Type 3
Network logoff Event ID 538 Type 3
Net use disconnection Event ID 538 Type 3
Autodisconnect Event ID 538 Type 3

When a user logs on or off the computer at the Windows NT console, the event is recorded in the Security Log. A successful log on event generates Event ID 528, Logon Type 2, and a User log off event generates Event ID 538, Logon Type 2, where Logon Type 2 indicates an interactive log on event. Double-click the event to bring up the Event Detail window, then check the Logon Type in the Description box.

The connection events are Logon Type 3, which indicates a network log on event. A successful Net Use or File Manager connection or a successful directed Net View to a Windows NT share generates Event ID 528, a successful log on event of Logon Type 3.

Windows 2000 logs event ID 578 whenever someone uses a user right. Event ID 578 identifies the user right with the term privilege. SeSecurityPrivilege is the short name for the Manage auditing and the security log right. This right lets you use Event Viewer to both view and clear the Security log and edit the audit control list of objects such as files, folders, printers, registry keys, and Active Directory (AD) objects. An object's audit control list specifies which types of access the Security log should record for that object. For example, you can audit each time someone successfully opens a file for write access.

I was trying to get a responce to Microsoft's statement "The OS occasionally neglects to log event ID 538. (So far, in Windows 2000, I've noticed this problem only for interactive logons.) In other words, you might see an event ID 528 that doesn't have a corresponding event ID 538."

This is a known flaw by Microsoft and has been around since NT. The 2x 578's were caught as a failed process during log outs and could be used to rep a log out. However, Microsoft said these were logged in error and fixed the problem in SP4. So now there is not correct log out function in Win2K.

This question was closed by the author