Article ID: 305822
Article Last Modified on 9/22/2006
APPLIES TO
- Microsoft Windows XP Professional
This article was previously published under Q305822
SYMPTOMS
With the welcome screen and logon/logoff and/or account logon success and failure auditing are enabled, pairs of Logon/Logoff failure or Account Logon failure audits with successful logon audit entries are added to the computer security log.
The events that are logged may resemble the following event:
CAUSE
Windows XP attempts a limited logon for each account that is displayed on the Welcome screen to determine whether to prompt the user for a password. An attempted logon is logged for each account displayed.
RESOLUTION
To resolve this problem, obtain the latest service pack for Windows XP. For additional information, click the following article number to view the article in the Microsoft Knowledge Base:
322389 How to Obtain the Latest Windows XP Service Pack
To prevent these events from being logged, disable the Welcome screen and use the classic logon screen or turn off auditing of logon events.
For additional information about how to enable or disable the Welcome screen and fast user switching, click the article number below to view the article in the Microsoft Knowledge Base:
279765 Description of Fast User Switching
To turn off auditing in the Microsoft Management Console (MMC) snap-in for Group Policy:
- Click Start, click Run, type gpedit.msc, and then click OK.
- In the left pane, expand the following items:
- Local Computer Policy
- Computer Configuration
- Windows Settings
- Security Settings
- Local Policy
- Click Audit Policy.
- Double-click Audit Logon Events.
- Click to clear the Success and Failure check boxes.
- Click OK.
- Close the Group Policy window.
STATUS
This behavior is by design. This problem was first corrected in Windows XP Service Pack 1.
MORE INFORMATION
If an account lockout policy is enabled, it is possible for an account to get locked out. The failed logon count will be reset when the user successfully logs on. However, since this happens to each account whenever the Welcome Screen is displayed, if the account lockout policy is set to 3 failed attempts, and User A logs in 3 times in a row, User B will have 3 failed attempts and the account will be locked out.
Additional query words: kbShell
Keywords: kbbug kbenv kberrmsg kbfix kbshell kbui kbwinxpsp1fix KB305822