Our Network Environment: Windows Server 2003 Active Directory domain
with a mix of Windows 2000 Pro and Windows XP Pro client computers.
All end users have domain accounts, no local client computer accounts.


Our Domain account/Desktop Computer Policy: Any end-user whose
computer is primarily a desktop is restricted from logging in or
accessing network resources between 12 am and 5:00 am. This restriction
is enforced in the configuration of the particular person's Domain
Account. Success and Failure is logged for all events on the Domain
Controllers (Account Logon/Logoff, Object Access, etc). Each desktop
has network drives mapped to shares on the domain controllers.

Our Problem: Most of these desktop users will "lock" their computers at
night instead of logging out.

For each end-user with a Windows XP desktop who locks his/her computer,
Time restriction events are logged all night. The pattern for each end
user is, 12 time restriction events are logged in 1 minute, all is
quiet for that particular end-user up to 3 hours, then another 12 time
restriction events are logged, repeat until 5:00 am passes. Group
Policy processing maybe?

For each end-user with a Windows 2000 desktop who locks his/her
computer, no Time restriction events are logged. I assume these
machines also run through normal Group Policy processing at this time
too. Why no log noise like Windows XP machines?

I would like to know what process on Windows XP desktops is causing
these events to be logged, so I can obliterate it at night and don't
have to sift through the resulting events the next morning in my quest
for actual, useful information (like when a user is really, actually,
physically at his or her computer attempting to log in or access server
resources late at night!).

Thanks for any assistance you can provide.