I have noticed on my Windows 2K box the log offs are not auditing correctly. I could not find a 539 Log out and I was directed to use service pack 3 and look for 2x 578. However, after SP3 I am not getting any type of (log out) only log ons.