Hi AllThere are around 25 workstations in a xp workgroup environment. In one of the machines auditing was enabled to capture failure login attempts. There was a lot of entries with event id 529 for failure attempts on this machine. A sample log pasted for reference.Event Type:Failure AuditEvent Source:SecurityEvent Category:Logon/Logoff Event ID:529Date:7/15/2009Time:3:41:34 PMUser:NT AUTHORITY\SYSTEMComputer:comp1234Description:Logon Failure:Reason:Unknown user name or bad passwordUser Name:AdministratorDomain:NARAYLogon Type:3Logon Process:NtLmSsp Authentication Package:NWV1_0Workstation Name:NARAYOn troubleshooting, we found that noone was trying to access the workstationon which auditing was enabled. But it still had entries for failed login attempts.As a second step, we setup another machines to capture failure logs, this machine was also on the same workgroup, it also captures failed login attemps from other machines on the workgroup.Further to this, we moved one of the auditing enabled machines to a test workgoup, but on the same subnet. Still this machine too was logging failure login attempts from earlier workgroup.Can you please help me on this.regardsVinod

Hey Vinod, Please use XP forum to get faster responses, this is Exchange Server - General Discussion forum... XP Forum:http://social.technet.microsoft.com/Forums/en-US/itproxpsp/threadsAmit Tank | MVP Exchange Server | MCITP: EMA | MCSA: M | http://ExchangeShare.WordPress.com