MonitorWare Knowledge Base

hi there
well i have a problem.. first of all...in security event log file of windows 2000.. i m receiving the entry of 538.i.e user logoff with annoymous username...when i logon with user name administrator it gives correct entry of 528..i.e.login with the Administrator user name..........but when i logoff with same user..it gives the entry of 538 with annoymous user .......
also i m recieving this entry multiple times against one logon with administrator username....
2nd problem is... how can i corelate with logon entry 528 username administrator against 538 logoff entry with respective annoymous user...
quick reply needed
thanks..

Hi,

you may have a look at this thread:

http://forum.adiscon.com/viewtopic.php?t=224

The bottom line is that there is no perfect solution. It seems hard to track. We are currently investigating this exact issue. If you would like to stay on top of the development, please subscribe to the above mentioned thread.

Rainer

i have already seen the paper regarding event id 538..but it didn't solve my problem....any idea how to track down those..as the id didn't remain the same when it comes against administrator log of...as it generated annoymous user with different id..some thing like(0x0, 0x5b45f1)...(different from administraotr log on entry)
waitng for reply
thanks

As I wrote, no definite answer yet. Stay tuned to the other thread I mentioned - we will post any updates there.

Rainer

My problem is that I am not seeing a 538 for a corresponding 528. Doesn't
matter if the user logged off successfully or not. I am running Win2000
SP3. Any ideas? Thanks.