Failure Events Are Logged When the Welcome Screen Is Enabled
Windows XP attempts a limited logon for each account that is displayed on the Welcome screen to determine whether to prompt the user for a password. An attempted logon is logged for each account displayed.
To prevent these events from being logged, disable the Welcome screen and use the classic logon screen or turn off auditing of logon events.