Posting this observation here (for now). We noticed a change in our login scripts, when moving from Windows XP SP1 to SP2 ... We've always written to the event log in our login scripts, here's the syntax of EventLog ...

Code:

LOGEVENT (type, ID, message, target, source)


we use it kinda like this (going way back to NT4):

Code:

$= LogEvent(4,@ERROR,"This is a message","", "LogonScript")


anyways, when we moved to SP2 the event logging suddenly stopped - after much debugging finally nailed it down the the fifth parameter ... "source".

The only way I could get event logging working under SP2 was to change the "source" to blank ("") ... in which case (in the event log itself) source shows up as the fully qualified path to kix32.exe.

My theory right now (anybody?) is that SP2 does not allow folks to write event entries with dubious "source" names - idk ... either that or there is something funky set in our base image (not known).

-Shawn