Options for detecting Windows XP

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

You could also grep for "Windows NT 5.1" in software.log or http.log

Scott