Event ID 538 question



cobra
07-09-2005, 10:53 PM
Hi we have win2k doman controller and exchange 2000, in the exchange 2000
event viewer, security log I see lots of event id 538 for one user

User Name: username
Domain: Domain
Logon ID: (0x0,0x4BC45BF1)
Logon Type: 3

Some times the user not even using the computer it is after working hours
I was wondering why this log recorded after working hours when the user is
not using the network?

Thanks

Emil Kvarnhammar
07-09-2005, 10:53 PM
http://www.monitorware.com/Common/en/SecurityReference/Event-ID-538-Explained.php

The reason for postings after working hours is probably that some computers
are left
running with mapped network drives (Logon Type: 3 is net use disconnect
etc.).

regards
Emil Kvarnhammar
http://www.ynax.com

"cobra" <cobra@discussions.microsoft.com> wrote in message
news:8A17B2A8-2BD9-4C5E-AC25-822C9580EC9C@microsoft.com...
> Hi we have win2k doman controller and exchange 2000, in the exchange 2000
> event viewer, security log I see lots of event id 538 for one user
>
> User Name: username
> Domain: Domain
> Logon ID: (0x0,0x4BC45BF1)
> Logon Type: 3
>
> Some times the user not even using the computer it is after working hours
> I was wondering why this log recorded after working hours when the user is
> not using the network?
>
> Thanks
>


Event ID 538 question