Failure Events Are Logged When the Welcome Screen Is Enabled

View products that this article applies to.

This article was previously published under Q305822

Expand all | Collapse all

SYMPTOMS

With the welcome screen and logon/logoff and/or account logon success and failure auditing are enabled, pairs of Logon/Logoff failure or Account Logon failure audits with successful logon audit entries are added to the computer security log.

The events that are logged may resemble the following event:

Event Type: Failure Audit
Event Source: Security
Event Category: Logon/Logoff
Event ID: 529
Date: date
Time: time
User: NT AUTHORITY\SYSTEM
Computer: %computer name%
Description:
Logon Failure:
Reason: Unknown user name or bad password
User Name: %user name%
Domain: %computer name%
Logon Type: 2
Logon Process: Advapi
Authentication Package: Negotiate
Workstation Name: %computer name%

For more information, see Help and Support Center at http://support.microsoft.com.

Event Type: Failure Audit
Event Source: Security
Event Category: Account Logon
Event ID: 680
Date: date
Time: time
User: NT AUTHORITY\SYSTEM
Computer: %computer name%
Description:
Logon attempt by: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon account: %user name%
Source Workstation: %computer name%
Error Code: 0xC000006A

For more information, see Help and Support Center at http://support.microsoft.com.

Event Type: Success Audit
Event Source: Security
Event Category: Account Logon
Event ID: 680
Date: date
Time: time
User: NT AUTHORITY\SYSTEM
Computer: %computer name%
Description:
Logon attempt by: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon account: %user name%
Source Workstation: %computer name%
Error Code: 0x0

For more information, see Help and Support Center at http://support.microsoft.com.

Back to the top

CAUSE

Windows XP attempts a limited logon for each account that is displayed on the Welcome screen to determine whether to prompt the user for a password. An attempted logon is logged for each account displayed.

Back to the top

RESOLUTION

To resolve this problem, obtain the latest service pack for Windows XP. For additional information, click the following article number to view the article in the Microsoft Knowledge Base:

322389 (http://support.microsoft.com/kb/322389/EN-US/ ) How to Obtain the Latest Windows XP Service Pack

To prevent these events from being logged, disable the Welcome screen and use the classic logon screen or turn off auditing of logon events.

For additional information about how to enable or disable the Welcome screen and fast user switching, click the article number below to view the article in the Microsoft Knowledge Base:

279765 (http://support.microsoft.com/kb/279765/EN-US/ ) Description of Fast User Switching

To turn off auditing in the Microsoft Management Console (MMC) snap-in for Group Policy:

Click Start, click Run, type gpedit.msc, and then click OK.
In the left pane, expand the following items:
- Local Computer Policy
- Computer Configuration
- Windows Settings
- Security Settings
- Local Policy
Click Audit Policy.
Double-click Audit Logon Events.
Click to clear the Success and Failure check boxes.
Click OK.
Close the Group Policy window.

Back to the top

STATUS

This behavior is by design. This problem was first corrected in Windows XP Service Pack 1.

Back to the top

MORE INFORMATION

If an account lockout policy is enabled, it is possible for an account to get locked out. The failed logon count will be reset when the user successfully logs on. However, since this happens to each account whenever the Welcome Screen is displayed, if the account lockout policy is set to 3 failed attempts, and User A logs in 3 times in a row, User B will have 3 failed attempts and the account will be locked out.

Back to the top