You also may want to audit account logon failures which may give additional
info. For domain user accounts account logon events would need to be enabled
in Domain Controller Security Policy. For local accounts it would need to be
enabled in Local Security Policy of the computer. If that does not help you
may need to use a software firewall to log traffic for that computer and
then match the firewall log with the security log by time. It could at least
give you an IP address. Sygate would be a good firewall for that and the
firewall function can be disabled which still allows the logging. --- Steve
http://www.snapfiles.com/Freeware/security/fwfirewall.html -- Sygate and
other firewalls available at this link.
