CVE-2002-2028: The screensaver on Windows NT 4.0, 2000, XP, and 2002 does not verify if a domain account has already been...

Security readout for executives and security teams

This is an old Windows workstation lock issue. On Windows NT 4.0, 2000, XP, and 2002, the screensaver unlock flow may accept a valid domain password without checking whether that domain account is already locked, weakening account-lockout protections for someone at the keyboard. Exposure is most plausible on legacy Windows NT 4.0, 2000, XP, or 2002 systems joined to a domain and relying on screensaver locks. Risk depends heavily on physical access and whether those systems still exist in production, labs, kiosks, or operational environments. Treat this as a legacy exposure management issue. It is unlikely to drive emergency response unless affected systems remain accessible, but unsupported Windows endpoints with physical access risk should be prioritized for retirement or compensating controls. Mitigation focus: Identify and retire unsupported affected Windows systems where possible.; Check Microsoft KB Q188700 and vendor guidance for available corrective action.; Strengthen physical access controls for legacy workstations..

Prepared

Jun 29, 2026, 19:05 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.