[logs] XP logon/logoff failure audit

From: Steve Wray (steve.wrayat_private)
Date: Fri Apr 19 2002 - 17:08:25 PDT

  • Next message: Wright, Joseph G (Gregory), SOLCM: "RE: [logs] BEEP: tcp based async message passing protocol/framework"

    Interesting feature in windows XP pro.
    Maybe someone knows how I can control it?
    :)
    
    If you allow the "welcome" logon screen,
    and you audit logon failures,
    XP generates an ongoing stream of logon failures.
    
    As I understand it, this is because XP displays
    users with no passwords differently on the
    welcome screen. It therefore needs to test each
    account to see if it needs a password.
    It does this repeatedly and generates a stream
    of logon failures.
    
    This issue is detailed here;
    http://support.microsoft.com/search/preview.aspx?scid=kb;en-us;Q305822
    
    Microsofts suggested fix is surprising;
    turn off the welcome screen or turn off logon auditing.
    
    The welcome screen is highly desirable; for example, most
    NT sysadmins I have known have their own login in the
    Administrators group, so that they can perform admin
    functions without having to log off and log on as
    Administrator.
    
    The welcome screen (& user switching) allows one to
    operate with normal user priviledge and switch to
    Administrator as needed.
    
    Auditing logon failures is also desirable.
    
    Has anyone come across any workarounds? Event viewer
    has a filter function that I've been fooling with
    but I'm unsure how to filter *just* these 'limited'
    logins. Suggestions would be a service to humanity!
    8-)
    
    
    
    
    ---------------------------------------------------------------------
    To unsubscribe, e-mail: loganalysis-unsubscribeat_private
    For additional commands, e-mail: loganalysis-helpat_private
    



    This archive was generated by hypermail 2b30 : Fri Apr 19 2002 - 21:26:39 PDT