Mysterious Admin Logon

[machinetype]

We have 3 nt 4 dc's When I got in this morning the pdc was not responding to network requests. In the event viewer it said at 11:25 the redirector was timing out, for info on this see:

http://www.eventid.net/display.aspeventid=3013&source=Rdr

But the strange part is after reviewing the security audits there was a succesful admin logon (with no failure audit for this account) at 11:19, which is 6 minutes before this. So do you all think that I actually had someone in here or something else is going on (dependecies on this account?) Also there was no workstation in this security audit.

Thanks in advance

SLM

 

[Grenage]

Aye we get those aswell throughout the night. We put them down to services such as BackupExec logging though, since they tied in.

 

[machinetype]

Veritas has it's own account doesn't it? For us it does, plus it does not happen everynight. Maybe it is though, I have seen stranger....

Thanks