Event ID 538 not recorded for user logoffs.

TheMSsForum.com: The Microsoft Software Forum

The MSS Forum ‹ Security
- Archive
  - Biz
  - MCSE
  - CRM
  - Drivers
  - Framework
  - ADO
  - ASP
  - Compact
  - Forms
  - Dotnet
  - C#
  - VB
  - FontpageGen
  - Excel
  - WorkSheet
  - Exchange
  - Setup
  - Fox
  - Fontpage
  - ASP
  - IIS
  - Entourage
  - Money
  - Messanger
  - PocketPC
  - Powerpoint
  - Project
  - Publisher
  - Excel
  - VB
  - Security
  - Portal
  - Services
  - SQLServerDev
  - SVCS
  - SQLServer
  - VB
  - VC
  - MFC
  - ExcelGen

- Previous
  - 1
    - cant get into email account I recently got my hard drive cleaned up and debugged at a local computer store. Ever since then, although everything else is working perfectly and much faster than before, I can no longer get into my email account. My daughter can get into hers. Mine is an Excite account, and although I can access the general Excite site, I cannot access my email account. The message reads that cookes and javascript have been disabled. I have no idea how to fix it. I phoned the computer store and they said that they could not walk me through it on the phone, that I would have to bring the hard drive back in again. I live about an hour and a half's drive away from the store, and it makes it difficult to do so right away. Is there any help or adivce that anyone here can give me? I miss being able to send and read my mail. Thank you. Tag: Event ID 538 not recorded for user logoffs. Tag: 69027
  - 2
    - Possible Email Attack Using Microsoft Received email purporting to be from www.communication3.msn.com urging me to click on link to initiate Windows Update Service. Link included what appeared to be complex identifier. I called Redmond, but couldn't get past frontdesk. Lady (nice lady) explained I had to forward email or to fax a copy. I explained that I would not (ever) open it in my computer because of potential security risk I perceived. Don't know if this is "real threat", but this is the only way I can think to alert community. Tag: Event ID 538 not recorded for user logoffs. Tag: 69018
  - 3
    - Is there an MS Patch Matrix available? Is there a resource somewhere that lays out all MS KB Patches by O/S ? I've looked in the Security section for 2 hours to no avail and would just like to know which patches are for NT4, 2000 Server, 2003, etc. without having to weed through 100's of clicks to compile it all.... TIA, -Bill Tag: Event ID 538 not recorded for user logoffs. Tag: 69017
  - 4
    - How do I find what computers a user is logged into? How do I find what computers a user is logged into? I work in a domain with over 80,000 users, with an equal number of computer objects, and over 30 DC's and we get users that log themselves into a computer and forget to logout of the computer. The next day they go to another computer and logon and change the password for the account. Since they did not logout of the first computer their user ID gets locked out. So, my question is how do I find the computer they forgot to logout of? Or, is there a tool like the old Banyan Vines "mlogout.exe" (wow, I just dated myself with that one) for the MS world to forcefully log the user out of any computer they are on? Thanks, Steve Tag: Event ID 538 not recorded for user logoffs. Tag: 69011
  - 5
    - ***FIX*** serflog.c virus, msn: Good afternoon folks... I have got rid of my virus!!!! Let me say this was NOT at all easy; the program that got rid of it was: http://www.free-av.com/ - antivir I completely understand the problems of the virus closing any program opened; so what you need to do is somehow get that package to your desktop, and run it by either clicking loads to overload your system, or by pressing return on your system, try get through the menus without closing the program - ignore 'close this program'? dialogues, it's the virus trying to close it! Click no then click on another button ie: shove the 'close? yes/no' dialogue box over the 'next' box, so when you press 'no' you can press 'next' in the install program... or use return again and keep your finger on it. Once it's installed, ensure you're connected through the net ( i guess you need broadband ideally...) and it'll update, then run it'll scan your computer manually (possibly with no windows displayed) and find the virus and scarily flash on your screen as the virus keeps closing it. This is because the virus closes most programs, and you'll have to be quick with your eyesight...take it easy, it'll keep flashing, so read what you can of them each time it flashes up. Restart your pc, and it should delete it, then find other parts of the virus... Tip: as it kept flashing up initially i managed to tick 'display info box' which came up with options, i changed the selection from 'always' to 'after restart', and the below option to 'delete virus' as opposed to close/clean/quarantine. It worked, and now i'm running without the serflog.c virus I do warn you, this is hard, but no other solution has worked successfully. I will be using this virus scanner from now on too! If you've any questions, please post here. To the 'regulars' if you could please put this in better words then maybe that would help people better. Unfortunately it's all about timing and overloading your CPU to install the program, but i can reassure you it does work! Until symantec produces a removal tool (if at all) this is the onl y method i have found that works. G. Tag: Event ID 538 not recorded for user logoffs. Tag: 69009
  - 6
    - winntsystem32autoexec.nt --error hi all i am getting problem when i try to install WinCVS application in my system.. the error message is the system file is not able to run windows and ms-dos application. Can anyone help me .. thanks ShankerBejjanki Tag: Event ID 538 not recorded for user logoffs. Tag: 69003
  - 7
    - Help With Unwanted Desktop Backround A spy ware removal ad appeared as my desk top two days ago.I cannot remove this no matter how many spyware programs I run.I tried a system restore several times also.Nothing has worked.Has anyone encountered this problem?Also a yellow triangle is in the toolbar causing a small popup every few minutes reminding me that my computer has spyware on it.Hope someone can help.Thanks...Joe Tag: Event ID 538 not recorded for user logoffs. Tag: 69001
  - 8
    - Is a rouge cancel bot on the lose in the usenet? Is a rouge cancel bot on the lose in the usenet? I have notice a a lot of cancelled messages in the computer and other general usenet groups. I am not talking about the bad groups. It even deleting messages on severs that don't support anytime of cancel message. Greg R Post also in the grc news group as well. Tag: Event ID 538 not recorded for user logoffs. Tag: 68998
  - 9
    - Will AD password policy change affect current users? If we modify the complexity of the Active directory user password policy will existing users with passwords that don't meet the new requirements be forced to change their password the next time they login or does this only affect new accounts and password changes? Thanks, Jim Tag: Event ID 538 not recorded for user logoffs. Tag: 68995
  - 10
    - Windows Messenger Problem I am using Windows Messenger 4.7.3001 and recently typed my password into to "email address" box on sign in by accient, now when anyone who uses this computer wants to use it and they click the arrow to show all previous login names - my password appears. I was wandering if I can clear this list somehow? Thanks, Tag: Event ID 538 not recorded for user logoffs. Tag: 68991
  - 11
    - Making Active X Safe or Signed I used QuickTime to make a small movie on my Web site. It came up on one computer using Win 2000 as unsafe. The Active X settings seem to be the same as on a second computer with OS Win 2000. I would think that QuickTime or any other common player or plugin would be safe and signed. How does one make such a slide presentation safe and signed??? AND Why are the settings for Active X in Internet Explorer 6 on Win 2000 different on one computer using the same OS than on another using Win 2000 OS??? When I go to Windows Updates the troubled computer does not need updates. How can I update Internet Explorer 6 to fix whatever is the problem? Is there a way? Thank you. Tag: Event ID 538 not recorded for user logoffs. Tag: 68990
  - 12
    - FileSpy Hi All, I have come across a piece of software called FileSpy which is running on my PC. I have done a bit of digging and this is a piece of software which is used to log and view when a file was accessed (and much more info but that is the general idea). What I can't find out is if it is a problem? I can't tell from the information I have read whether it is / isn't. Does anybody have any knowledge of this item? Is this file something which I have been tricked into installing but provides access to external users or is it something which is used by other applications Tag: Event ID 538 not recorded for user logoffs. Tag: 68988
  - 13
    - Hotmail Sign Out Problem When I try to sign out of Hotmail, I can see that IE is trying to pull up the standard MSN logout page, but very quickly, IE stops processing the page, indicates that it is done, but I end up with a blank page. I have all updates from Microsoft except XP SP2, which I uninstall after experiencing problems with browsing. I have a fast ADSL connection, so I know it's not the speed. I'm also current on running anti-virus and anti-spyware searches. It doesn't appear that my pop-up blocker is the issue either. I'm concerned that I'm not completely logging out of Hotmail and I'm not comfortable just closing out the browser since I fear there might be a bigger issue. Any idea? Tag: Event ID 538 not recorded for user logoffs. Tag: 68983
  - 14
    - Error in Internet Explorer The following message comes up when opening Internet Explorer. This page provides potentially unsafe information to an Active X control. Your current security settings prohibit running controls in this manner. As a result, this page may not Display correctly. I have run the virus protection, Ad-Aware, Spybot. Nothing seems to help. Any suggestions??? Thank you Tag: Event ID 538 not recorded for user logoffs. Tag: 68978
  - 15
    - Security myths Security myths. http://www.microsoft.com/technet/community/columns/secmgmt/sm0305_2.mspx I disagree with number one. That like telling people to throw out Steve(grc.com) and others advice. Look at myth number four. I strongly disagree with it. I think tweaks are needed. Even Microsoft recommended some tweaks Greg R Tag: Event ID 538 not recorded for user logoffs. Tag: 68976
  - 16
    - Msn Profiles Out of curiousity. Are there any security issues which prevent other msn users from uploading copywritten or personal pictures, or claiming they are you? And if so is it legal to send threatining emails under this false identity. If it is not could you direct me towards the area where I can report such Activity. Tag: Event ID 538 not recorded for user logoffs. Tag: 68969
  - 17
    - what firewalls to use? i am trying to read and research the best way to setup the firewalls you need for your computer. Do certain firewalls conflict with each other where its better to run one than the other. In my house we use a d-Link router, now can than be considered a hardware firewall. On my computer I run Windows Xp home edition with the service pack 2. that has the security center and firewall does this replace the internet connection firewall. Is the serivce pack sufficent enough and give you the best protection. I also have on my computer Norton System works 2005 premier si there anything on there that will conflict with the firewalls where I should disable one thing and enable another. I would like it so the protection from things getting into my computer is ias ggod as things on my computer being able to leak out for people to see them. i am just trying to learn the best possible way to protect everything if that is possible. I hope you can help me with some knwledge thanks jake Tag: Event ID 538 not recorded for user logoffs. Tag: 68965
  - 18
    - usbkeyblock Does anyone know what usbkeyblock is? I found it running in sys tray. Tag: Event ID 538 not recorded for user logoffs. Tag: 68962
  - 19
    - Can't use cached credentials on non-domain member workstations I have users whose machines are not memebers of the domain, and I want them to be able to access resouces (Exch 2003, web folders, ftp folders, etc...) using cached credential from their workstation logins. Even when selecting "Remember My Password," they have to supply credentials at least once per session. They work exclusively remotely via the Internet, without VPN. How can I get W2K3 & Exch2K3 to accept non-domain member machine login cached credentials? Thanks. Tag: Event ID 538 not recorded for user logoffs. Tag: 68960
  - 20
    - changing Administrator password I'm running an NT4 based domain. I'd like to change the built-in Administrator account password. My boss tried changing it before I worked here, and he says everything stopped working and he had to call a guy to come change it back. That was kind of vague to me, but I know at least Exchange stopped working, as well as a Visual Foxpro based database application that users access via a file share. I know I need to take appropriate steps for changing the Service Account in Exchange, and I'll deal with BackupExec as well. I did a query on the services on both servers, and it appears that everything else is using the LocalSystem account. Is there anything else I should check for, to be certain that there are no more dependencies on the Administrator account? Thanks, Dave Tag: Event ID 538 not recorded for user logoffs. Tag: 68958
  - 21
    - Desktop Icon I had removed the security setting from my pc ans ened up with a chat icon with a user name. I didn't install anything but got it??????? Tag: Event ID 538 not recorded for user logoffs. Tag: 68954
  - 22
    - OpenSSH on Windows Server 2003 Hi, all. I'm not sure if this is the right forum for this topic, but I'm having a problem with an OpenSSH for Windows 3.8.1p1-1 installation on Windows Server 2003. I installed the software a couple of times before in various environments. I had some diffficulties while trying to install it in high security environments (that suffered some hardening procedures), but in time learned how to set it up correctly. All of those platforms were Windows 2000 Server. Now I'm trying to make it run on 2k3. I'm pretty sure that I've set all NTFS permissions correctly, meaning RW allowed on working folders and RX allowed on programme folders for specifically allowed SSH users (at least those proved to be sufficient). But when trying to connect to that SFTP server using some known SFTP clients (like FileZilla or PSFTP), it doesn't let me get there. I've enabled DEBUG logging level and can clearly see in Application Log that it recognizes the user and authenticates it (at least to itself, meaning it confirmes the password), but suddenly says that the login attempt failed. I'm very much puzzled. I had similar problems on 2k and solved them by editing Local Security Policy where I added those SSH users to "Access this computer from the network" and "Allow log on locally". So I've added the same policy entries to this server, but with no improvements. Anyone? Many thanks in advance. Bye. Tag: Event ID 538 not recorded for user logoffs. Tag: 68953
  - 23
    - 24-7-search.com browser hijacker I have tried most varieties of trying to remidy this on one of my stand alone PC's to no avail. even restoring to another point has failed. (adnoware used, hijackthis used norton used, even regedit). So I am obviously missing some deep dark whole that it has attached itself. Any help grateful. -- Dave Tag: Event ID 538 not recorded for user logoffs. Tag: 68952
  - 24
    - Passwords When I log onto a site and have to enter a user name and password, as soon as I start the first letter of the user name the full user name pops up along with the password already there. I must have asked windows to remember my user name and password. I really don't remember. This is a personal account and I would like to be able to change the "remember user name and password" so that anyone that might go to the site on my computer won't be able to just click and be signed on. My question is "How do I delete or remove the user name and password from being remembered by windows and make me manually sign in?" Thank you. Tag: Event ID 538 not recorded for user logoffs. Tag: 68945
  - 25
    - updates Using Windows XP Home, SP2 Getting message updates are available for download. How do I know if they are "critical updates" or just updates that are available. How do I know if they are needed if they are not "critical"? Thanks in advance. Tag: Event ID 538 not recorded for user logoffs. Tag: 68937
- Next
  - 1
    - Interesting Spyware report from US FTC Here is an interesting report from the US Federal Trade Commission (www.ftc.gov) on Spyware http://www.ftc.gov/os/2005/03/050307spywarerpt.pdf I thought this quote was an eye opener! "According to this panelist, there are 800 million computers in use worldwide, of which 50% do not have even basic protections against virus attacks, despite years of consumer education about viruses. However, the other 50% - or 400 million computer users - have installed anti-virus protection, and industry can build on that base in addressing spyware. Consumer education may be particularly useful with teens, because it is often the teens in a household who are engaging in the online activities that lead to installation of spyware." BB Tag: Event ID 538 not recorded for user logoffs. Tag: 68929
  - 2
    - Download updates for Windows before adding to network? How can I download all the updates for a particular type of Windows? I want to download them on a safe pc and apply them via sneakernet BEFORE I put another pc on the network. Right now, I am interested in Windows Server 2003 Std & XPP. Thanks Tag: Event ID 538 not recorded for user logoffs. Tag: 68925
  - 3
    - MSN How to blok MSN which ports I need to block Tag: Event ID 538 not recorded for user logoffs. Tag: 68921
  - 4
    - Norton AntiVirus 2005 Program Update (English)/583.3 KB RE: Norton AntiVirus 2005 Program Update (English)/583.3 KB Is this NECESSARY to install from the AV 2005 package? What IS it...and what does it actually do? Thanks - Infnet Tag: Event ID 538 not recorded for user logoffs. Tag: 68918
  - 5
    - Security Center Will Not Find My CA Antivirus Windows XP Security Center will not find my CA antivirus software. At first it was working just fine, said "on" for all three settings, now, within the past few days it's saying not found. Anyone know any issues going on with this?? Any fixes? Tag: Event ID 538 not recorded for user logoffs. Tag: 68911
  - 6
    - MS04-028 /MS05-FEBScan Hi, I'm using SMS 2003 and was wondering if these 2 new tools replaces the former Update Scan Tool or are they all used together so that you actually needs 3 tools to distribute security updates with SMS. Dennis Tag: Event ID 538 not recorded for user logoffs. Tag: 68910
  - 7
    - Best freeware available? My computer is not working properly and is running extremely slow and does not access the internet using the quick keys. I have to access them from my favorites! I'm in need of some desperate help....... Not only that,when I try to install Winfax pro the computer won't download it all the way and is stuck somewhere in the middle. I try to uninstall it but it's not listed,and when I try to reload it, the prompt says there is a previous version already installed. I've spent all day trying to fix this thing! ( please HELP ) Thank you, Rick Tag: Event ID 538 not recorded for user logoffs. Tag: 68878
  - 8
    - Is it safe to open a text file in Internet Explorer? My question is in the title. -- Jim Carlock Please post replies to newsgroup. Tag: Event ID 538 not recorded for user logoffs. Tag: 68875
  - 9
    - Spyware Blaster 3.3 Spyware Blaster 3.3 has been issued and is now available for download at: http://www.javacoolsoftware.com/sbupdate.html Tom Tag: Event ID 538 not recorded for user logoffs. Tag: 68873
  - 10
    - Patch deployment files issue When you install Microsoft patches the files that are created are stored under a directory. I assume it is this is to allow the patches to be uninstalled. My question is: Is there a way of removing these files without jeopardizing the system? We currently have space issues (C drive) on some servers and the more patches that are issued will cause more problems. Thanks very much. Tag: Event ID 538 not recorded for user logoffs. Tag: 68832
  - 11
    - is the _vti_pvt folder safe? i just found that this site http://www.broken-ice.com/hack_site/lessons/ has a link to a webpage on my site ( http://mysite/_vti_pvt/ ) (go to the bottom of first webpage and you will see a list of website addresses all ending with with _vti_pvt/ and my site is one of them. the problem is i don't understand why it is there (the site is in arabic !). i am guessing from the website adress that it has something to do with hacking (and i also figured out it has soemthing to do with frontpage) actually, the page in question belongs to my team mate. and the server is running on my computer. i am running Apache/2.0.52 (Win32) Server on win xp pro sp2 according to the control panel, i have both Microsoft Professional Edition 2003 as well as Microsoft XP Professional with FrontPage installed (i just found that out !) i have been using office 2003 though for the last one year. and i had just assumed that office 2003 installed OVER the previous install of office XP. is my system vulnerable becuase of this page ? if so, what should i do to protect it? if this is not the right newsgroup, pls let me know where i should go with this question. appreciate any help... thank you, julian. Tag: Event ID 538 not recorded for user logoffs. Tag: 68825
  - 12
    - IPMSG.EXE Some of the users on our compnay network have been found to be using IP based network messeging program ipmsg.exe downloaded from some site.I have couple of queries: 1. Is it unsafe to permit such prorams to be there on network? 2. what are the issues? 3. Can this be stopped , say , by disabling Windows Messenger Service on individaul computers. 4.How to disable it from firewall? Regards Sanjeev Tag: Event ID 538 not recorded for user logoffs. Tag: 68822
  - 13
    - problems with hotmail I sent a mail to a contact, but when the succesful delivery message appeared, the adress of my contact had been changed to "******@hotmail.cc" instead of "******@hotmail.com". That person never received the mail and I never received a delivery notification failure message. Where did that mail go? Why did it change if i had wroten ".com"? May I have any virus? Tag: Event ID 538 not recorded for user logoffs. Tag: 68820
  - 14
    - Dream Pack? Need to get into PC w/PW from fired employee I'm trying to help a former client of mine who is somewhat elderly but still runs a small public accounting firm. He has fired his longtime trusted assistant after, you guessed it, she embezzled funds. She knew much more about computers than him and she was the network (small network) administrator. I think he has most problems under control but she placed a PW on her PC and it has important company files on it (in addition to evidence). I've heard of something called "Dream Pack" that is open source and cheap, and which will allow him to get into the PC and just change the password to whatever he wants and gain access to it. I do not have time to travel to his little office but I really want to help this old guy. He is like a grandfather type guy and I just want to point him in the direction of something that will open that computer and perhaps I can walk him through the steps over the phone. Has anybody heard of this software and can anybody give me any leads on this? I'm an Excel/Access/Word programmer but I don't know operating system or security stuff. Thanks for any help. -- RMC,CPA Tag: Event ID 538 not recorded for user logoffs. Tag: 68804
  - 15
    - Permission Problem/RPC function failure I am having a permission problem with my Windows Server 2003 System. I am attempting to access a HP StorageWorks optical 220mx via QStar software. Qstar has troubleshot the issue to a permission problem. *Please note that I also have problems accessing folders/files on a fat partition of my drive as well and I believe this may be directly related to this same permissions problem. The following is an email explaining their (QStar) findings: Yahoo! Mail - wcdep@yahoo.com Print - Close Window From:"Corey Mayer" <cmayer@qstar.com> To:"'rae frainco'" <wcdep@yahoo.com>, kworkman@qstar.com Subject:RE: White County Sheriff Office Date:Thu, 3 Mar 2005 08:37:25 -0600 Hi Ray, Here is more detail of what is happening. When a user accesses any remote SMB server, Explorer opens srvcvs on share IPC$ and communicates thru srvcvs with NetShareEnum (which is Windows RPC function). If this fails (i.e. remote SMB server replies â??not supportedâ??) Explorer will then call SMB_TRANSACT with function LM_SHARE_ENUM_API, which is a regular request in SMB documentation. The NetShareEnum is Windows specific RPC call and Microsoft has never documented this function, therefore we cannot use this function. So, Explorer will first attempt to use Microsoft RPC function and then if this fails it will use standard SMB function. For your 2 users when they try to connect to QStar the regular Microsoft RPC function fails with â??not supportedâ?? and instead of calling SMB function the user attempts 10 times before giving up on Microsoft RPC function and using SMB function instead. From the debug logs we could see the user that has no issues did not attempt as many times. I am investigating this issue and trying to find a configuration parameter within Windows that will stop the users from attempting 10 times before giving up. If it is as you say "not a QStar issue", than please explain to me why these two personnel never previously had problems accessing the folder/files before it was copied to the jukebox and governed by the QStar system? I am making the assumption that prior to QStar you were using a share on a Windows machine. If so, then the reason is because a Windows server can accept the NetShareEnum connection. Hope this helps explain the situation we are seeing. Thanks Corey ------------------------------------ QStar Technologies, Inc. Corey Mayer Technical Support Engineer cmayer@qstar.com 99 Eglin Pkwy #37 Ft. Walton Beach, FL 32548 tel: 850-243-0900 ext. 209 fax: 850-243-4234 www.qstar.com ------------------------------------ From: rae frainco [mailto:wcdep@yahoo.com] Sent: Thursday, March 03, 2005 7:19 AM To: Corey Mayer; kworkman@qstar.com Subject: RE: White County Sheriff Office If it is as you say "not a QStar issue", than please explain to me why these two personnel never previously had problems accessing the folder/files before it was copied to the jukebox and governed by the QStar system? Corey Mayer <cmayer@qstar.com> wrote: Ray, I just wanted to give you an update. I have discussed the issue in more detail with my development team; they have concluded that this is not a QStar issue but Windows. I will do some investigation to see if we can find some configuration parameters within Windows to solve the issue with the 2 users. Thanks Corey ------------------------------------ QStar Technologies, Inc. Corey Mayer Technical Support Engineer cmayer@qstar.com 99 Eglin Pkwy #37 Ft. Walton Beach, FL 32548 tel: 850-243-0900 ext. 209 fax: 850-243-4234 www.qstar.com ------------------------------------ From: rae frainco [mailto:wcdep@yahoo.com] Sent: Tuesday, March 01, 2005 3:02 PM To: Corey Mayer Subject: RE: White County Sheriff Office And the fix is... Corey Mayer <cmayer@qstar.com> wrote: Ray, Looks like we found what the problem is. Authentication server responds up to 3 seconds. There are 2 types of SMB requests which can be sent to a SMB server from a SMB client b_ a regular and enhanced. Microsoft SMB server supports both, however QStar supports just the regular request. The reason why QStar only supports the regular request is because the enhanced request uses undocumented Microsoft RPC calls. So what happens is the client first sends enhanced request, QStar responds b_ not supported, then client sends regular request, QStar serves the request. Looking at the logs we found that one client performs this procedure just once, but the other client repeats it 10 times before using regular request and each time it also has to get authentication from the server. The behavior depends on client only. My development team feels that there must be some configuration for client communication properties, probably on the server. Also, my development team felt that 3 second response time from the authentication server was a bit slow the normal speed should be 0.5 seconds. Tag: Event ID 538 not recorded for user logoffs. Tag: 68801
  - 16
    - Active Directory Does anyone know how to automatically join a predetermined OU in the active directory when you join a domain? Thank in advance. Mike Tag: Event ID 538 not recorded for user logoffs. Tag: 68799
  - 17
    - CLSID_CCertView Hi all, I am using CoCreateInstance(CLSID_CCertView,...) I get the error "Undeclared identifier. --- CLSID_CCertView." I am using all the libs and dlls and headers.. eg . Certidl.lib, certadm.dll, Certsrv.h. Somebody please enlighten me... Is this a version conflict... I am using visual studio 6 on windows server 2003. i registered certadm.dll thanks in advance chan Tag: Event ID 538 not recorded for user logoffs. Tag: 68792
  - 18
    - Security Audit Does anyone know if the Security Audit Log logs and entry when a user or user group is added to the Security Setting or a Network Share? Tag: Event ID 538 not recorded for user logoffs. Tag: 68781
  - 19
    - Security Audit Does anyone know if the Security Audit Log logs an audit when a user or user group was added to the security setting of a Share or Hard Drive? Tag: Event ID 538 not recorded for user logoffs. Tag: 68779
  - 20
    - Spyware Beta 1 Has anyone else encountered the problem of thier system rebooting or hanging from standbye mode after installing and running the Spyware Beta? Thanks Elaine Beaurauxgart-Weiderhoff Tag: Event ID 538 not recorded for user logoffs. Tag: 68777
  - 21
    - Monitoring Servers Hey guys, I have a network with about 14 windows 2003 servers, Exchange 2003, and we also host our two website in house. We have a PIX firewall and an IDS System on the outside of the PIX. But I really need a good solution for securing and monitoring our servers and network. right now I really have no way of telling if someone has gotten in to our network. I've looked around a lot and havent really found anythign that will do what I need. Can someone give me some ideas? thats for all the help Jason Tag: Event ID 538 not recorded for user logoffs. Tag: 68753
  - 22
    - Spyware assistance required!! I recently came across an app on my machine which I am told is a Spyware app with a threat capability described as 'guarded'. Meanwhile my virus update provider has told me that Microsoft provide a free Anti-Spyware app that can be downloaded from the M'Soft website which will guard and protect against such threats in future. Is this so? And if so can someone point me to the appropriate link? I use my PC for alot of security sensitive transactions and the idea of a Spyware app sitting on my PC is not particularly appealing? Can such apps compromise security by recording passwords etc ...?? Any help would be greatly appreciated, Don- Tag: Event ID 538 not recorded for user logoffs. Tag: 68750
  - 23
    - security word hi, There is a word box on some websites that asks you to type what you see in it.I would like to know what is that and how dos it work. thanks Tag: Event ID 538 not recorded for user logoffs. Tag: 68742
  - 24
    - Kelvir.B worm My PC infected by this Kelvir.B worm because I click on a URL in a message reading: "lol! see it! u'll like it" Any1 can help me.... HELLPPP !!! Thanks a bunch. Tag: Event ID 538 not recorded for user logoffs. Tag: 68730
  - 25
    - Security Summit Downloads... Hi there, I have twice tried downloading the "Introduction to Programming with SQL Server 2005" materials from the Security Summit recently held in capital cities around OZ (the link is provided below). Unfortunately the file appears to be corrupt as it gives the following error when attempting to open it after d/load: "Powerpoint can't read this file. The file you tried to open does not appear to be a PowerPoint file (.ppt). Check the original file to find out the real file type; you may be able to edit it in another program designed for that file type." Can someone refer this to the appropriate MS personnel? Thanks, Kim. http://download.microsoft.com/documents/australia/security/summit/presentations/Introduction_To_Programming_With_SQL_Server_2005.ppt Tag: Event ID 538 not recorded for user logoffs. Tag: 68728

Hello,

When looking at the Security log (W2K, SP4), I see the 528 event for
when a user logs on but I'm not seeing a matching 538 for the logoff.

I've double-checked the Local Security Policy | Local Policies | Audit
Policies | Audit Logon Events and both the effective setting and local
settings are set to Success and Failure.

In...

http://www.microsoft.com/technet/prodtechnol/windows2000serv/maintain/monitor/logonoff.mspx

...this is described as a bug but that isn't very helpful. Does anyone
know more as to why this is happening? Is there a fix? or is this
something I have to deal with?

Thanks!

Top