Event ID 528 and 538

From: Kevin (kevinhendrix_at_yahoo.com)
Date: 09/04/03

Date: Wed, 3 Sep 2003 23:31:20 -0400

I am showing access (logon and logoff) on a workstation at
a time when I was not present. Is there a flaw in NT 40 or
is it a trojan or software package doing that? I am at a
loss. I am in the domain admins group. Please enlighten
me. Thanks in advance for any info...