Hello to all:
I know this is often a UNIX-based list, but I thought I'd see if I can
extract some Windows knowledge anyway...
I have a machine with auditing enabled, and have found some Event ID 551 (User
initiated logoff), then, at some point much later (hours or days) a subsequent
Event ID 538 (User logoff). There is no logon event anywhere near close to the
logoffs. These are on a Windows XP w/SP2 system on a Samba domain.
Microsoft's KB article 828857 is probably the closest I can get, but it is not
completely what I am getting.
Has anyone else experienced this:
- Event ID: 551 - Logoff - normal timestamp person might be using system
- Event ID: 538 - Logoff - long after ID 551 - possibly 12 hours, possibly
several days (when sorted by user)
Thanks.
Scott
_______________________________________________
bblisa mailing list
[email protected]
http://www.bblisa.org/mailman/listinfo/bblisa
