I have a terminal server with 2003 sp2 that shows some odd behavior. A user can log off the server using the log off function. This will generate an event in the security log #551 (User initiated logoff). The corresponding event 538 does not appear sometimes until hours later for that logoff event. Any ideas what this is about? Thanks!