Server 2003 Event Viewer Question

[whatsys]

In the Security event viewer on a Windows 2003 DC, what does it mean when a user is listed for Event ID's 680, 538 and 540 over 1000 times in 24 hours? The 680 is always the same:

Logon attempt by MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
logon account: homer
source workstation: PC_1

Homer shouldnt be anywhere near PC_1, let alone logging on to the domain from it.

Thanks for any insight!

 

[Shad007]

i had a similar scenario recently where it was discovered that the culprit was running HP Security Protection tools on his laptop. it was writing to the security event log almost every second...an uninstall of this software cleared it up.