Microsoft KB Archive/285148

= Event ID 637 Message Is Logged Stating that a User Removed Another User =

Article ID: 285148

Article Last Modified on 11/1/2006

-

APPLIES TO


 * Microsoft Windows NT Server 4.0 Standard Edition

-



This article was previously published under Q285148



SYMPTOMS
If the Audit feature of account management is enabled, an administrator may receive an event ID 637 message stating that a user removed another user from a group even though the user has not removed any users.



CAUSE
This behavior can occur whenever the user views the group even in situations where the user is only viewing the group, not deleting any other users.

If a member of a group had been previously deleted, and then a user uses the User Manager tool (Usrmgr.exe) to only view the group, the tool shows that users have been deleted.



STATUS
This behavior is by design.

Keywords: kbenv kberrmsg kbprb KB285148

-

[mailto:TECHNET@MICROSOFT.COM Send feedback to Microsoft]

© Microsoft Corporation. All rights reserved.