I have set up a user on Vista that matches the user on XP,

So consider using a domain instead. There's a lot to be said for how
Active Directory hides all this nonsense.

Meanwhile, check to be sure that all machines have their time AND timezone
sync'd together.