Windows XP Security Logs Posting to Windows 2000 Station   

We have a few XP computers in a workgroup. The Security Event Logs are blank 
on the station, but I've found that the Failure alerts are showing up in the 
Security Logs on a single Windows 2000 station. This is actually happening in 
2 separate workgroups.

Example: I mess up the password on my station. I then go to this Windows 
2000 computer, and go to the Event Logs for Security, and see the log for my 
password mess-up.

Has anyone seen this before?
Has anyone heard of such a thing or know how it is being re-directed?

Thanks in advance!

date: Mon, 5 May 2008 07:12:01 -0700   author:   Rick

Re: Windows XP Security Logs Posting to Windows 2000 Station   

Rick  wrote:
> We have a few XP computers in a workgroup. The Security Event Logs
> are blank on the station, but I've found that the Failure alerts are
> showing up in the Security Logs on a single Windows 2000 station.
> This is actually happening in 2 separate workgroups.
>
> Example: I mess up the password on my station. I then go to this
> Windows 2000 computer, and go to the Event Logs for Security, and see
> the log for my password mess-up.
>
> Has anyone seen this before?
> Has anyone heard of such a thing or know how it is being re-directed?
>
> Thanks in advance!

This sounds normal to me. If you're in a workgroup, it's a common config to 
have matching usernames & passwords on each computer (this is one of the 
reasons to get a server & AD!).

So, if workstationA uses a login name of Joe and a password of Password, and 
connects to WorkstationB (which has identical usernames/passwords), and Joe 
"messes up" his password and tries to connect to a resource on WorkstationB, 
*that* won't work & it will show you errors. Until you equally "mess up" the 
password on WorkstationB.

date: Mon, 5 May 2008 10:36:43 -0400   author:   Lanwench [MVP - Exchange]

Re: Windows XP Security Logs Posting to Windows 2000 Station   

The stations are technically in a Windows Workgroup Environment, but the 
users are authenticating to a Novell network. Since the security logs are 
staying inside the workgroups, I determined it was a Windows workgroup issue.

I did find however if I changed Auditing settings in Local Station Security 
on the receiving station, I was able to pick up other login Failure events as 
well. I now know how to turn it on and off, but I still don't know why it is 
happening.

"Lanwench [MVP - Exchange]" wrote:

> Rick  wrote:
> > We have a few XP computers in a workgroup. The Security Event Logs
> > are blank on the station, but I've found that the Failure alerts are
> > showing up in the Security Logs on a single Windows 2000 station.
> > This is actually happening in 2 separate workgroups.
> >
> > Example: I mess up the password on my station. I then go to this
> > Windows 2000 computer, and go to the Event Logs for Security, and see
> > the log for my password mess-up.
> >
> > Has anyone seen this before?
> > Has anyone heard of such a thing or know how it is being re-directed?
> >
> > Thanks in advance!
> 
> This sounds normal to me. If you're in a workgroup, it's a common config to 
> have matching usernames & passwords on each computer (this is one of the 
> reasons to get a server & AD!).
> 
> So, if workstationA uses a login name of Joe and a password of Password, and 
> connects to WorkstationB (which has identical usernames/passwords), and Joe 
> "messes up" his password and tries to connect to a resource on WorkstationB, 
> *that* won't work & it will show you errors. Until you equally "mess up" the 
> password on WorkstationB. 
> 
> 
>

date: Mon, 5 May 2008 07:51:01 -0700   author:   Rick