This article was previously published under Q305822
With the welcome screen and logon/logoff and/or account logon success and failure auditing are enabled, pairs of Logon/Logoff failure or Account Logon failure audits with successful logon audit entries are added to the computer security log.
The events that are logged may resemble the following event:
Event Type: Failure Audit Event Source: Security Event Category: Logon/Logoff Event ID: 529 Date: date Time: time User: NT AUTHORITY\SYSTEM Computer: %computer name% Description: Logon Failure: Reason: Unknown user name or bad password User Name: %user name% Domain: %computer name% Logon Type: 2 Logon Process: Advapi Authentication Package: Negotiate Workstation Name: %computer name%
For more information, see Help and Support Center athttp://support.microsoft.com.
For more information, see Help and Support Center at http://support.microsoft.com.
Windows XP attempts a limited logon for each account that is displayed on the Welcome screen to determine whether to prompt the user for a password. An attempted logon is logged for each account displayed.
To resolve this problem, obtain the latest service pack for Windows XP. For additional information, click the following article number to view the article in theMicrosoft Knowledge Base:
322389 How to Obtain the Latest Windows XP Service Pack
To prevent these events from being logged, disable the Welcome screen and use the classic logon screen or turn off auditing of logon events.
For additional information about how to enable or disable the Welcome screen and fast user switching, click the article number below to view the article in the Microsoft Knowledge Base:
To turn off auditing in the Microsoft Management Console (MMC) snap-in for Group Policy:
Click Start, click Run, type gpedit.msc, and then click OK.
In the left pane, expand the following items:
Local Computer Policy
Click Audit Policy.
Double-click Audit Logon Events.
Click to clear the Success and Failure check boxes.
Close the Group Policy window.
This behavior is by design. This problem was first corrected in Windows XP Service Pack 1.
If an account lockout policy is enabled, it is possible for an account to get locked out. The failed logon count will be reset when the user successfully logs on. However, since this happens to each account whenever the Welcome Screen is displayed, if the account lockout policy is set to 3 failed attempts, and User A logs in 3 times in a row, User B will have 3 failed attempts and the account will be locked out.