Windows XP Security Logs Posting to Windows 2000 Station

[Rick]

We have a few XP computers in a workgroup. The Security Event Logs are blank
on the station, but I've found that the Failure alerts are showing up in the
Security Logs on a single Windows 2000 station. This is actually happening in
2 separate workgroups.

Example: I mess up the password on my station. I then go to this Windows
2000 computer, and go to the Event Logs for Security, and see the log for my
password mess-up.

Has anyone seen this before?
Has anyone heard of such a thing or know how it is being re-directed?

Thanks in advance!

 

[Lanwench [MVP - Exchange]]

We have a few XP computers in a workgroup. The Security Event Logs
are blank on the station, but I've found that the Failure alerts are
showing up in the Security Logs on a single Windows 2000 station.
This is actually happening in 2 separate workgroups.

Example: I mess up the password on my station. I then go to this
Windows 2000 computer, and go to the Event Logs for Security, and see
the log for my password mess-up.

Has anyone seen this before?
Has anyone heard of such a thing or know how it is being re-directed?

Thanks in advance!

This sounds normal to me. If you're in a workgroup, it's a common config to
have matching usernames & passwords on each computer (this is one of the
reasons to get a server & AD!).

So, if workstationA uses a login name of Joe and a password of Password, and
connects to WorkstationB (which has identical usernames/passwords), and Joe
"messes up" his password and tries to connect to a resource on WorkstationB,
*that* won't work & it will show you errors. Until you equally "mess up" the
password on WorkstationB.

 

[Rick]

The stations are technically in a Windows Workgroup Environment, but the
users are authenticating to a Novell network. Since the security logs are
staying inside the workgroups, I determined it was a Windows workgroup issue.

I did find however if I changed Auditing settings in Local Station Security
on the receiving station, I was able to pick up other login Failure events as
well. I now know how to turn it on and off, but I still don't know why it is
happening.