[Full-Disclosure] Windows 2000 Logout events are not monitored!

[Darren Bennett]

It's possible this has been on the list before but I'm going to check
anyway. With windows 2000 (server is the platform I have tested), when
auditing of login/logout events is enabled, only login events are
recorded. This appears to be a bug with Windows. I have tried applying a
patch from Microsoft that is supposed to fix this and the patch didn't
work. Anyone else seen this behavior? Any suggestions on how I could
record logout events without relying on MS?

	-Thanks,

		Darren

 
-----------------------------------------------
Darren Bennett - CISSP
Sr. Systems Administrator/Manager
Science Applications International Corporation
Advanced Systems Development and Integration
-----------------------------------------------