We setup our NT4 server to audit logon/logoff via the Event Logging and we found that an NT4 workstation that is left logged on overnight is logging on/off every 5 min overnite when the office is closed, what could be causing this? are there settings in NT that is causing the security event logs (ID 528 and ID 538)?
