Event ID's 576, 540 & 538 show up w/ user id - user is not logged into that computer

2k Server, 2k Workstation.

This started yesterday, went away when the server was rebooted but is
back. The frequency it's showing up in the logs is every minute and a
half.

None of the sysinternals tools is giving me what I need. No task is
set up under this user's credentials, no mapped drives from workstation
to server.

Any ideas?

Thanks!
Mary

.

Relevant Pages