Windows XP Security Logs Posting to Windows 2000 Station

  • Thread starter Thread starter Rick
  • Start date Start date
R

Rick

We have a few XP computers in a workgroup. The Security Event Logs are blank
on the station, but I've found that the Failure alerts are showing up in the
Security Logs on a single Windows 2000 station. This is actually happening in
2 separate workgroups.

Example: I mess up the password on my station. I then go to this Windows
2000 computer, and go to the Event Logs for Security, and see the log for my
password mess-up.

Has anyone seen this before?
Has anyone heard of such a thing or know how it is being re-directed?

Thanks in advance!
 
Rick <Rick@discussions.microsoft.com> wrote:
> We have a few XP computers in a workgroup. The Security Event Logs
> are blank on the station, but I've found that the Failure alerts are
> showing up in the Security Logs on a single Windows 2000 station.
> This is actually happening in 2 separate workgroups.
>
> Example: I mess up the password on my station. I then go to this
> Windows 2000 computer, and go to the Event Logs for Security, and see
> the log for my password mess-up.
>
> Has anyone seen this before?
> Has anyone heard of such a thing or know how it is being re-directed?
>
> Thanks in advance!

This sounds normal to me. If you're in a workgroup, it's a common config to
have matching usernames & passwords on each computer (this is one of the
reasons to get a server & AD!).

So, if workstationA uses a login name of Joe and a password of Password, and
connects to WorkstationB (which has identical usernames/passwords), and Joe
"messes up" his password and tries to connect to a resource on WorkstationB,
*that* won't work & it will show you errors. Until you equally "mess up" the
password on WorkstationB.
 
The stations are technically in a Windows Workgroup Environment, but the
users are authenticating to a Novell network. Since the security logs are
staying inside the workgroups, I determined it was a Windows workgroup issue.

I did find however if I changed Auditing settings in Local Station Security
on the receiving station, I was able to pick up other login Failure events as
well. I now know how to turn it on and off, but I still don't know why it is
happening.

"Lanwench [MVP - Exchange]" wrote:

> Rick <Rick@discussions.microsoft.com> wrote:
> > We have a few XP computers in a workgroup. The Security Event Logs
> > are blank on the station, but I've found that the Failure alerts are
> > showing up in the Security Logs on a single Windows 2000 station.
> > This is actually happening in 2 separate workgroups.
> >
> > Example: I mess up the password on my station. I then go to this
> > Windows 2000 computer, and go to the Event Logs for Security, and see
> > the log for my password mess-up.
> >
> > Has anyone seen this before?
> > Has anyone heard of such a thing or know how it is being re-directed?
> >
> > Thanks in advance!
>
> This sounds normal to me. If you're in a workgroup, it's a common config to
> have matching usernames & passwords on each computer (this is one of the
> reasons to get a server & AD!).
>
> So, if workstationA uses a login name of Joe and a password of Password, and
> connects to WorkstationB (which has identical usernames/passwords), and Joe
> "messes up" his password and tries to connect to a resource on WorkstationB,
> *that* won't work & it will show you errors. Until you equally "mess up" the
> password on WorkstationB.
>
>
>
 
Back
Top