Had a situation where a workstation was not processing the default domain
policy when the user was logging on to the domain. Last username still
displayed when logging on, etc. Finally determined that
C:\WINDOWS\security\Database\SECEDIT.SDB must have been corrupt.

Through Security Configuration and Analysis, I created a new SECEDIT.SDB
database. When you do this you are prompted to select a template. I chose
securews.inf. If this is just a cookie cutter XP installation, would this be
the correct default template to use in this situation?

I seemed to have resolved the problem, but noticed in the
C:\WINDOWS\security\logs\winlogon.log file that there were some Undo value
lines and Mismatch lines.

Thanks.