[Last Call] Learn how to a build a cloud-first strategyRegister Now

  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 811
  • Last Modified:

event id 540 and 538

We have a couple of users that are generating event id 540 and 538 on our domain controller. We have auditing enabled. When i look at the event logs for either of these users it shows various logon/logoff times even when the user is not at the office and has claimed to have shut down their machine. This came up because they claimed to have shut down their pc at night (not log off) but when they came in their login screen was up and email was open. I'm trying to sift through my event logs to give the manager their login/logout times but there are quite a few all through the night. That user does not have remote access so trying to ascertain which are legitimate login/logout times is difficult especially with so many event id 540 and 538 entries. Can you clear this up for me and explain what i may need to look out for?
Frank Ferrer
Frank Ferrer
1 Solution
Justin OwensITIL Problem ManagerCommented:

Featured Post

Independent Software Vendors: We Want Your Opinion

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

Tackle projects and never again get stuck behind a technical roadblock.
Join Now