I've searched for help on this without any success so far. We have an XP (home) user who fills the NT 4.0 (SP6a) server's security log every day. Every 15-20 seconds, there is both an event 528 and 538 for this one user (the two events almost always come in pairs). I've checked to see what programs are running on her machine; usually it is just outlook 2000 and a database program, both accessing files on a different computer (not the NT server). She doesn't have any network drives mapped. We have other XP (home & pro) users on the network who run the same two programs and only have a couple of 528 & 538 logs a day. I haven't been able to find any settings that differ between her and the other users. Any help would be appreciated - I've increased the size of the log file, but we're still sometimes filling it up before I can clear it.