We experiment very long delay when a misstyped username is entered for opening a session on windows XP (login in to a domain).... But, the same problem occur even if we logon locallly...
Not sure but if we also diconnect the network cable, the delay seem to be normal but as XP change this delay in a normal fashion to avoid hacker trying too many login/password, it's hard to be absolutelly sure about this "Normal delay" because sometimes, even with the cable unplugged, it's long.
We have enable the "UserEnvDebugLevel" registry to track this, but nothing, maybe because it's only involve when a session is opening (after valid username/pass)...
Nothing from the ventviewer too!!!
It can take about 10 minutes !
for next step see the pic. It is self explanatory.
And if you try on domain with wrong password it depends upon the server account lockdown settings that for how long it will lock the account