event id 540 and 538

Posted on 2010-01-06
Last Modified: 2013-12-06
We have a couple of users that are generating event id 540 and 538 on our domain controller. We have auditing enabled. When i look at the event logs for either of these users it shows various logon/logoff times even when the user is not at the office and has claimed to have shut down their machine. This came up because they claimed to have shut down their pc at night (not log off) but when they came in their login screen was up and email was open. I'm trying to sift through my event logs to give the manager their login/logout times but there are quite a few all through the night. That user does not have remote access so trying to ascertain which are legitimate login/logout times is difficult especially with so many event id 540 and 538 entries. Can you clear this up for me and explain what i may need to look out for?
Question by:GroundskeeperIt
    1 Comment
    LVL 31

    Accepted Solution


    Write Comment

    Please enter a first name

    Please enter a last name

    We will never share this with anyone.

    Featured Post

    How your wiki can always stay up-to-date

    Quip doubles as a “living” wiki and a project management tool that evolves with your organization. As you finish projects in Quip, the work remains, easily accessible to all team members, new and old.
    - Increase transparency
    - Onboard new hires faster
    - Access from mobile/offline

    Large and small networks have one same need, Service monitoring. Service monitoring consists of watch services of the several servers in the network. To monitor means that the administrator will receive an alert when a service is down or it's state …
    A quick step-by-step overview of installing and configuring Carbonite Server Backup.
    Here's a very brief overview of the methods PRTG Network Monitor ( offers for monitoring bandwidth, to help you decide which methods you´d like to investigate in more detail.  The methods are covered in more detail in o…
    This video gives you a great overview about bandwidth monitoring with SNMP and WMI with our network monitoring solution PRTG Network Monitor ( If you're looking for how to monitor bandwidth using netflow or packet s…

    737 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    22 Experts available now in Live!

    Get 1:1 Help Now