Windows XP Logon Auditing in the Security Log

Auditing user logon events in Windows XP provided administrators with a detailed record of local and network access attempts recorded directly in the operating system's Security log. By configuring policies within the Local Security Policy console, the operating system generated specific legacy event identification numbers detailing successful and failed logon attempts, user credentials, and access types. This article explains how logon auditing was configured, the distinction between logon categories, and the specific event identifiers recorded in the Windows XP Event Viewer.

Configuration via Local Security Policy

Logon auditing in Windows XP was disabled by default. Administrators enabled it through the Local Security Policy management console (secpol.msc) under Security Settings > Local Policies > Audit Policy. Administrators had the option to monitor events based on two outcomes: Success and Failure.

Windows XP divided logon tracking into two distinct policies:

  • Audit logon events: Tracked session activity where the resource was accessed, documenting when a user logged on or off the local XP machine (interactively or across the network).
  • Audit account logon events: Tracked the validation of credentials where the account resided. For a standalone Windows XP machine, this occurred locally; for a domain-joined machine, this occurred on the domain controller.

Key Event IDs in Windows XP

Windows XP used legacy event identification codes (primarily in the 500 range), prior to the four-digit 4600-series introduced in Windows Vista. When logon auditing was enabled, the following primary Event IDs were written to the Security log:

  • Event 528 (Successful Logon): Recorded when a user successfully authenticated locally, through a remote desktop session, or via a service.
  • Event 529 (Logon Failure): Recorded when a logon attempt failed due to an unknown username or an incorrect password.
  • Event 538 (User Logoff): Generated when a user session was terminated.
  • Event 540 (Successful Network Logon): Logged when a remote user authenticated across the local network to access shared files or printers.
  • Events 530 through 537: Indicated specific failure conditions, such as logon time restrictions (530), disabled accounts (531), expired accounts (532), or workstation restrictions (533).

Understanding Logon Types

Inside an Event 528 entry, Windows XP categorized the mechanism of entry using numeric Logon Types:

  • Logon Type 2 (Interactive): The user logged on directly at the local physical keyboard and console.
  • Logon Type 3 (Network): A connection was established across the network to access shared resources like shared folders or IIS web services.
  • Logon Type 4 (Batch): A scheduled task or batch process initiated the logon.
  • Logon Type 5 (Service): A Windows service started under a specific user account.
  • Logon Type 10 (RemoteInteractive): The user connected to the computer via Remote Desktop Protocol (Terminal Services).

Log Storage and Limitations

Logged entries were viewed using the Event Viewer (eventvwr.msc). Windows XP maintained the Security log in a proprietary binary format (%SystemRoot%\System32\Config\SecEvent.Evt). Because the default maximum log size was limited to just a few megabytes, heavily utilized systems required administrators to configure log wrapping rules—such as overwriting events as needed or archiving them manually—to prevent the loss of critical audit trails.