Unauthorized PC use

I doubt they are using the cancel to get around the login screen. Especially if you are in domain environment. They have probably guessed or found a users' password. For starters I would have all users change their passwords. If you are in a domain environment you could also use User Manager for Domains and restrict the login times.
You could also let things go for a while and turn on auditing to see which username and password has been lifted. the audit will show the user and times of the login/logoff. These times should obviously correspond to the times the after hours cleaning crew is in.

hope this has helped.

Coopachi is absolutely correct and I would follow his advice. I can think of a case where they would be able to by pass the login because we had it here. When you have a mixed Novell \ Microsoft environment, and Novell is the primary login \ authenticator. If your users are Windows 95 or 98 then they can escape past the login screen and the browser will still see and be able to use the firewall \ internet proxy server for surfing the net. I would first do ALL that answer one said, audit, force password changes, find out which userid is being used (if any), and restrict login times. On the windows 9x PC's you can edit the registry to force validation to the network so that windows will not run without authentication from a server.

HKEY_LOCAL_MACHINE\Network\Logon\MustBeValidated

Type in the new D Word "MustBeValidated" then once it's added, double click to edit it and change the default value from 0 to 1.

Hope this helps.

Are your users actually shutting down their systems?
If they place them into standby, or allow them to go into standby mode automatically, it would be very easy for someone to use them at any time.

One extra security step that you can take is torequire users to set a screen saver password.

Chas