Logoff event messages are not logged in the security log when you use the Audit Logon Events feature in Windows 2000

This article was previously published under Q318253
This article has been archived. It is offered "as is" and will no longer be updated.
Symptoms
When you turn on the Audit Logon Events feature to track logon and logoff events, you may receive logon event messages (Event 528 Type 2) in the security log. However, you may not receive user logoff event messages (Event 538 Type 2) in the security log.
Resolution

Hotfix information

A supported hotfix is available from Microsoft. However, this hotfix is intended to correct only the problem that is described in this article. Apply this hotfix only to systems that are experiencing this specific problem.

If the hotfix is available for download, there is a "Hotfix download available" section at the top of this Knowledge Base article. If this section does not appear, submit a request to Microsoft Customer Service and Support to obtain the hotfix.

Note If additional issues occur or if any troubleshooting is required, you might have to create a separate service request. The usual support costs will apply to additional support questions and issues that do not qualify for this specific hotfix. For a complete list of Microsoft Customer Service and Support telephone numbers or to create a separate service request, visit the following Microsoft Web site: Note The "Hotfix download available" form displays the languages for which the hotfix is available. If you do not see your language, it is because a hotfix is not available for that language.

Prerequisites

No prerequisites are required.

Restart requirement

You must restart your computer after you apply this hotfix.

Hotfix replacement information

This hotfix does not replace any other hotfixes.

File information

The English version of this hotfix has the file attributes (or later) that are listed in the following table. The dates and times for these files are listed in coordinated universal time (UTC). When you view the file information, it is converted to local time. To find the difference between UTC and local time, use the Time Zone tab in the Date and Time tool in Control Panel.
   Date         Time   Version            Size    File name   -----------------------------------------------------------   26-Sep-2002  23:59  5.0.2195.6069     124,176  Adsldp.dll          26-Sep-2002  23:59  5.0.2195.5781     131,344  Adsldpc.dll         26-Sep-2002  23:59  5.0.2195.5781      62,736  Adsmsext.dll        26-Sep-2002  23:59  5.0.2195.6052     358,160  Advapi32.dll        26-Sep-2002  23:59  5.0.2195.5265      42,256  Basesrv.dll         26-Sep-2002  23:59  5.0.2195.6058      49,424  Browser.dll         26-Sep-2002  23:59  5.0.2195.6012     135,952  Dnsapi.dll          26-Sep-2002  23:59  5.0.2195.6012      96,016  Dnsrslvr.dll        26-Sep-2002  23:59  5.0.2195.5722      45,328  Eventlog.dll        26-Sep-2002  23:59  5.0.2195.5907     222,992  Gdi32.dll           26-Sep-2002  23:59  5.0.2195.6059     146,704  Kdcsvc.dll          06-Sep-2002  01:18  5.0.2195.6048     200,976  Kerberos.dll        26-Sep-2002  23:59  5.0.2195.6011     708,880  Kernel32.dll        21-Aug-2002  16:27  5.0.2195.6023      71,248  Ksecdd.sys   26-Sep-2002  23:59  5.0.2195.6044     250,640  Localspl.dll        26-Sep-2002  02:01  5.0.2195.6072     507,664  Lsasrv.dll          26-Sep-2002  02:01  5.0.2195.6072      33,552  Lsass.exe           26-Sep-2002  23:59  5.0.2195.4733     332,560  Msgina.dll          27-Aug-2002  22:53  5.0.2195.6034     108,816  Msv1_0.dll          26-Sep-2002  23:59  5.0.2195.5979     307,472  Netapi32.dll        26-Sep-2002  23:59  5.0.2195.5966     360,720  Netlogon.dll        26-Sep-2002  23:59  5.0.2195.6048     918,800  Ntdsa.dll           26-Sep-2002  23:59  5.0.2195.5985     940,304  Ole32.dll           26-Sep-2002  23:59  5.0.2195.6040     429,328  Rpcrt4.dll          26-Sep-2002  23:59  5.0.2195.6066     186,128  Rpcss.dll           26-Sep-2002  23:59  5.0.2195.6025     389,392  Samsrv.dll          26-Sep-2002  23:59  5.0.2195.5951     129,296  Scecli.dll          26-Sep-2002  23:59  5.0.2195.5951     302,864  Scesrv.dll          10-Sep-2002  15:50  5.0.2195.6053     123,392  Sp3res.dll          26-Sep-2002  23:59  5.0.2195.6047      79,632  Spoolss.dll         13-Jun-2001  05:05  5.0.2195.3727       3,856  Svcpack1.dll        26-Jun-2001  02:17  3.10.0.103         47,808  User.exe   26-Sep-2002  23:59  5.0.2195.6063     380,176  User32.dll          26-Sep-2002  23:59  5.0.2195.5968     369,936  Userenv.dll         26-Sep-2002  23:59  5.0.2195.5859      48,912  W32time.dll         04-Jun-2002  21:32  5.0.2195.5859      57,104  W32tm.exe           25-Sep-2002  18:04  5.0.2195.6070   1,642,512  Win32k.sys   12-Sep-2002  19:50  5.0.2195.6056     179,472  Winlogon.exe        26-Sep-2002  23:59  5.0.2195.5936      81,680  Winscard.dll        26-Sep-2002  23:59  5.0.2195.5935     243,472  Winsrv.dll          26-Sep-2002  23:59  5.0.2195.6052     126,224  Wldap32.dll         26-Sep-2002  02:01  5.0.2195.6072     507,664  Lsasrv.dll          26-Sep-2002  23:59  5.0.2195.6011     708,880  Kernel32.dll        26-Sep-2002  23:59  5.0.2195.6070   1,642,512  Win32k.sys   26-Sep-2002  23:59  5.0.2195.5935     243,472  Winsrv.dll       
Status
Microsoft has confirmed that this is a problem in the Microsoft products that are listed in the "Applies to" section.
More information
For additional information about the new file naming schema for Microsoft Windows software update packages, click the following article number to view the article in the Microsoft Knowledge Base:
816915 New file naming schema for Microsoft Windows software update packages
Properties

Article ID: 318253 - Last Review: 10/26/2013 08:14:00 - Revision: 6.0

Microsoft Windows 2000 Server, Microsoft Windows 2000 Professional Edition, Microsoft Windows 2000 Advanced Server

  • kbnosurvey kbarchive kbautohotfix kbhotfixserver kbqfe kbwin2000presp4fix kbbug kbfix KB318253
Feedback
ERROR: at System.Diagnostics.Process.Kill() at Microsoft.Support.SEOInfrastructureService.PhantomJS.PhantomJSRunner.WaitForExit(Process process, Int32 waitTime, StringBuilder dataBuilder, Boolean isTotalProcessTimeout)