Will WinXP Service Pack 1a Screw Up My Computer?

[Eric]

I want to get rid of the annoying bug that causes the "failed login" entries
in the security log when you use the "Welcome" logon screen.

I've been told and read elsewhere that the numerous "failed logon" attempts
by advapi in the security log are simply just attempts by winxp itself to
login to existing accounts with a blank password. I take it that if a blank
password is found, then winxp will change the way logins and fast-switching
of users are presented?

I found and read this article:
--------------------------
Microsoft Knowledge Base Article - 305822
Failure Events Are Logged When the Welcome Screen Is Enabled

SYMPTOMS
With the welcome screen and logon/logoff and/or account logon success and
failure auditing are enabled, pairs of Logon/Logoff failure or Account Logon
failure audits with successful logon audit entries are added to the computer
security log.

RESOLUTION
To resolve this problem, obtain the latest service pack for Windows XP.
--------------------------

Okay, so I go and check what the "latest service pack" is. I find the last
two service packs for WinXP were SP1 and SP1a. First, I decide to read more
before just installing SP1a.

I go to:
--------------------------
Microsoft Knowledge Base Article - 813926
Differences Between Windows XP SP1 and Windows XP SP1a

MORE INFORMATION
To determine if you are running Windows XP SP1, right-click My Computer, and
then click Properties. If "Service Pack 1" appears under System, you are
already running Windows XP SP1. There is no benefit to installing SP1a if
you are already running Windows XP SP1. Microsoft does not recommend that
you install SP1a if you are already running SP1.
--------------------------

When I look at the system properties, I find that "Service Pack 1" appears.

So, the only way to fix the annoying security audit bug is by installing
SP1a -- but if I do that then I will potentially screw up my computer since
all the "hot fixes" that Windows Update has installed since SP1 will be
overwritten with earlier version of files?

I have a terrible feeling that if I try to install SP1a its going to
seriously screw up my computer. Isn't there a way to fix the "audit bug"
without having to install the whole SP? Obviously there is something in the
SP that fixes it. Why can't Microsoft just make whatever it is available
instead of making you get trapped in catch-22 situation????

 

[Jim Eshelman]

I have a terrible feeling that if I try to install SP1a its going to
seriously screw up my computer. Isn't there a way to fix the "audit bug"
without having to install the whole SP?

No, it really shouldn't be a problem, especially because it uninstalls
easily.

There is a quirk between my computer's hardware and SP1. Such
incompatibilites can occur. In my case, it wasn't worth sorting it out
(nothing particular that I really needed SP1 for) so I uninstalled it --
which happened quite smoothly and without residual.

--
Jim Eshelman, MS-MVP Windows
http://aumha.org/
http://forum.aumha.org/

Did you find this newsgroup on the web? A newsreader like Outlook Express
will make your online life a lot easier. Get better help!
See: http://aumha.org/win4/supp1b.htm and
http://support.microsoft.com/support/news/howto/default.asp

 

[Eric]

Now, I have read that SP1a is the exact same thing as SP1, except it doesn't
have the "Virtual Machine" since Sun is suing Microsoft. I have SP1
installed, including all the hotfixes afterwards, so it would foolish to
install SP1a. Doing so would probably break things left and right. Well, I
suppose this also proves that the "solution" given in Article 305822 (below)
doesn't work! I have SP1 installed and still have the annoying security
audit bug!

 

[Eric]

From a deja search, just found an article posted by Eric Fritzgerald at MS
stating:

"I'm working with the shell team to change this behavior, but it's unlikely
to change until Longhorn. The thought is that the intersection of (users
who use the welcome screen) + (users who audit) is small, and changes to the
logon components can be destabilizing."

I guess I'll just live with it...

Is this a piece of the dirty laundry?