I am logging both successful and unsuccessful log in events to my NT 4.0 PDC
All my clients are w2k pro. All the users log out at the end of the day and actually restart their pc's. I have physically verified this. Let's say everyone logs out between 4pm and 5pm. All the logoff events show up in the event logs and the usernames and pc's and times are correct. The problem is that when i come in the next morning to check the logs, sometimes there is another duplicate log off event for a user and a pc. Let's say user x loged off machine y at 4pm. That is validated and is in the log. Then the next morning there may be another log off event, same exact event, but the time is 7:15am. How can a user log off again with out logging on. The other weird thing is that i know this user in question didnt' log in until 8am and that successful log in event is recorded properly. Any guesses.
Thanks
All my clients are w2k pro. All the users log out at the end of the day and actually restart their pc's. I have physically verified this. Let's say everyone logs out between 4pm and 5pm. All the logoff events show up in the event logs and the usernames and pc's and times are correct. The problem is that when i come in the next morning to check the logs, sometimes there is another duplicate log off event for a user and a pc. Let's say user x loged off machine y at 4pm. That is validated and is in the log. Then the next morning there may be another log off event, same exact event, but the time is 7:15am. How can a user log off again with out logging on. The other weird thing is that i know this user in question didnt' log in until 8am and that successful log in event is recorded properly. Any guesses.
Thanks