Logon tracking sometimes does not show in the event log when a user or computer has logged off, even though I know the user is NOT logged in anymore.

Microsoft Windows 2000 and earlier have a problem where the logoff events with event ID 538 (which are intercepted by EventSentry) are sometimes not logged to the security event log.

Since the "Logon Tracking" feature of EventSentry depends on audit events being written to the security event log, Logon Tracking cannot work properly if the OS is not writing enough information to the event log.

Please contact Microsoft for a fix for this problem or see the additional link below.