You are currently offline, waiting for your internet to reconnect

Failure Events Are Logged When the Welcome Screen Is Enabled

Support for Windows XP has ended

Microsoft ended support for Windows XP on April 8, 2014. This change has affected your software updates and security options. Learn what this means for you and how to stay protected.

This article was previously published under Q305822
SYMPTOMS
With the welcome screen and logon/logoff and/or account logon success and failure auditing are enabled, pairs of Logon/Logoff failure or Account Logon failure audits with successful logon audit entries are added to the computer security log.

The events that are logged may resemble the following event:
Event Type: Failure Audit
Event Source: Security
Event Category: Logon/Logoff
Event ID: 529
Date: date
Time: time
User: NT AUTHORITY\SYSTEM
Computer: %computer name%
Description:
Logon Failure:
Reason: Unknown user name or bad password
User Name: %user name%
Domain: %computer name%
Logon Type: 2
Logon Process: Advapi
Authentication Package: Negotiate
Workstation Name: %computer name%

For more information, see Help and Support Center athttp://support.microsoft.com.


Event Type: Failure Audit
Event Source: Security
Event Category: Account Logon
Event ID: 680
Date: date
Time: time
User: NT AUTHORITY\SYSTEM
Computer: %computer name%
Description:
Logon attempt by: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon account: %user name%
Source Workstation: %computer name%
Error Code: 0xC000006A

For more information, see Help and Support Center athttp://support.microsoft.com.


Event Type: Success Audit
Event Source: Security
Event Category: Account Logon
Event ID: 680
Date: date
Time: time
User: NT AUTHORITY\SYSTEM
Computer: %computer name%
Description:
Logon attempt by: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon account: %user name%
Source Workstation: %computer name%
Error Code: 0x0

For more information, see Help and Support Center at http://support.microsoft.com.
CAUSE
Windows XP attempts a limited logon for each account that is displayed on the Welcome screen to determine whether to prompt the user for a password. An attempted logon is logged for each account displayed.
RESOLUTION
To resolve this problem, obtain the latest service pack for Windows XP. For additional information, click the following article number to view the article in theMicrosoft Knowledge Base:
322389 How to Obtain the Latest Windows XP Service Pack
To prevent these events from being logged, disable the Welcome screen and use the classic logon screen or turn off auditing of logon events.

For additional information about how to enable or disable the Welcome screen and fast user switching, click the article number below to view the article in the Microsoft Knowledge Base:
279765 Description of Fast User Switching
To turn off auditing in the Microsoft Management Console (MMC) snap-in for Group Policy:
  1. Click Start, click Run, type gpedit.msc, and then click OK.
  2. In the left pane, expand the following items:
    • Local Computer Policy
    • Computer Configuration
    • Windows Settings
    • Security Settings
    • Local Policy

  3. Click Audit Policy.
  4. Double-click Audit Logon Events.
  5. Click to clear the Success and Failure check boxes.
  6. Click OK.
  7. Close the Group Policy window.
STATUS
This behavior is by design. This problem was first corrected in Windows XP Service Pack 1.
MORE INFORMATION
If an account lockout policy is enabled, it is possible for an account to get locked out. The failed logon count will be reset when the user successfully logs on. However, since this happens to each account whenever the Welcome Screen is displayed, if the account lockout policy is set to 3 failed attempts, and User A logs in 3 times in a row, User B will have 3 failed attempts and the account will be locked out.
kbShell
Properties

Article ID: 305822 - Last Review: 09/22/2006 03:28:48 - Revision: 2.1

  • Microsoft Windows XP Professional
  • kbbug kbenv kberrmsg kbfix kbshell kbui kbwinxpsp1fix KB305822
Feedback