Event ID 637 Message Is Logged Stating that a User Removed Another User (285148)


The information in this article applies to:

  • Microsoft Windows NT Server 4.0
This article was previously published under Q285148

SYMPTOMS

If the Audit feature of account management is enabled, an administrator may receive an event ID 637 message stating that a user removed another user from a group even though the user has not removed any users.

CAUSE

This behavior can occur whenever the user views the group even in situations where the user is only viewing the group, not deleting any other users.

If a member of a group had been previously deleted, and then a user uses the User Manager tool (Usrmgr.exe) to only view the group, the tool shows that users have been deleted.

STATUS

This behavior is by design.
Modification Type:MajorLast Reviewed:8/8/2001
Keywords:kbenv kberrmsg kbprb KB285148
©2002 Microsoft Corporation. All rights reserved.