Event ID: 538 Seems to lock out users

I've been trying to fugue out a problem where users get locked out of
the system and we have to reboot the system to get back in. Today it
happened twice in about a 45 minute period, and i noticed Event ID: 538
at each point of lock. It reported that there was an error with the
administrators log-on and that it was a bad password. No one was
logging on to the server at that point, so I'm wondering what else
might be trying to access the system as administrator. I checked
services and scheduled jobs, but didn't find anything.

Can anyone suggest what else to check for the solution? Thanks!

Mick

.