No announcement yet.

Logon/Logoff Events on Multiple XP Machines

  • Filter
  • Time
  • Show
Clear All
new posts

  • Logon/Logoff Events on Multiple XP Machines

    Hello there,
    My question is concerning the Event ids 538/540/576.
    I know these events are regarding logons, logoffs, and privileged use. This is clear so far.
    The part that I don't know is why these events show up on numerous other
    pcs' logs on our LAN. I would have expected these events to show up
    on the server logs not on client pcs as well. Not sure on this one. On my pc the same 3 clients appear in my event log, no one else.
    I would appreciate it if someone can give me an explanation for this.

    Many thanks

  • #2
    Re: Logon/Logoff Events on Multiple XP Machines

    These are audit returns.

    However (and I'm no expert) you may have a problem with anonymous logons to your PC's

    Check these out.

    As to why you are getting these, from what I've read either there's a problem or you have maybe changed the audit policy on client machines?
    The Univurse is still winning!

    W2K AD, WSUS, RIS 2003. ISA also AVG Server
    ** If contributors help you, recognise them and give reputation points where appropriate **


    • #3
      Re: Logon/Logoff Events on Multiple XP Machines

      Hello Andy,
      Thanks for the info. Will have a look at the links you sent me.
      I don't believe there is a "problem" as such. It'll teach me to have a look in the
      logs. I was surprised that a) there were these events on my pc in the first place and
      b) why it is always the same clients.
      It just appears that other pcs are trying to logon to my pc. I know this is not the case. I was just wondering what is different about those other pcs compared to the
      hundred or so other pcs we have on the LAN.
      One of the pcs in question is actually a Windows 98 pc. We still have quite a few of those.

      Thanks again for your reply