Microsoft KB Archive/305822

= Failure Events Are Logged When the Welcome Screen Is Enabled =

Article ID: 305822

Article Last Modified on 9/22/2006

-

APPLIES TO


 * Microsoft Windows XP Professional

-



This article was previously published under Q305822



SYMPTOMS
With the welcome screen and logon/logoff and/or account logon success and failure auditing are enabled, pairs of Logon/Logoff failure or Account Logon failure audits with successful logon audit entries are added to the computer security log.

The events that are logged may resemble the following event:

Event Type: Failure Audit

Event Source: Security

Event Category: Logon/Logoff

Event ID: 529

Date: date

Time: time

User: NT AUTHORITY\SYSTEM

Computer: %computer name%

Description:

Logon Failure:

Reason: Unknown user name or bad password

User Name: %user name%

Domain: %computer name%

Logon Type: 2

Logon Process: Advapi

Authentication Package: Negotiate

Workstation Name: %computer name%

For more information, see Help and Support Center at http://support.microsoft.com.

Event Type: Failure Audit

Event Source: Security

Event Category: Account Logon

Event ID: 680

Date: date

Time: time

User: NT AUTHORITY\SYSTEM

Computer: %computer name%

Description:

Logon attempt by: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0

Logon account: %user name%

Source Workstation: %computer name%

Error Code: 0xC000006A

For more information, see Help and Support Center at http://support.microsoft.com.

Event Type: Success Audit

Event Source: Security

Event Category: Account Logon

Event ID: 680

Date: date

Time: time

User: NT AUTHORITY\SYSTEM

Computer: %computer name%

Description:

Logon attempt by: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0

Logon account: %user name%

Source Workstation: %computer name%

Error Code: 0x0

For more information, see Help and Support Center at http://support.microsoft.com.



CAUSE
Windows XP attempts a limited logon for each account that is displayed on the Welcome screen to determine whether to prompt the user for a password. An attempted logon is logged for each account displayed.



RESOLUTION
To resolve this problem, obtain the latest service pack for Windows XP. For additional information, click the following article number to view the article in the Microsoft Knowledge Base:

322389 How to Obtain the Latest Windows XP Service Pack

To prevent these events from being logged, disable the Welcome screen and use the classic logon screen or turn off auditing of logon events.

For additional information about how to enable or disable the Welcome screen and fast user switching, click the article number below to view the article in the Microsoft Knowledge Base:

279765 Description of Fast User Switching

To turn off auditing in the Microsoft Management Console (MMC) snap-in for Group Policy:  Click Start, click Run, type gpedit.msc, and then click OK. In the left pane, expand the following items:  Local Computer Policy Computer Configuration Windows Settings Security Settings</li> Local Policy</li></ul>

</li> Click Audit Policy.</li> Double-click Audit Logon Events.</li> Click to clear the Success and Failure check boxes.</li> Click OK.</li> Close the Group Policy window.</li></ol>

<div class="status_section">

STATUS
This behavior is by design. This problem was first corrected in Windows XP Service Pack 1.

<div class="moreinformation_section">

MORE INFORMATION
If an account lockout policy is enabled, it is possible for an account to get locked out. The failed logon count will be reset when the user successfully logs on. However, since this happens to each account whenever the Welcome Screen is displayed, if the account lockout policy is set to 3 failed attempts, and User A logs in 3 times in a row, User B will have 3 failed attempts and the account will be locked out.

Additional query words: kbShell

Keywords: kbbug kbenv kberrmsg kbfix kbshell kbui kbwinxpsp1fix KB305822

-

[mailto:TECHNET@MICROSOFT.COM Send feedback to Microsoft]

© Microsoft Corporation. All rights reserved.