Policy Change indeed picked up something...:
Source: Security
Category: Policy Change
Event ID: 622
User: NT AUTHORITY\SYSTEM
Computer: BOSS

System Security Access Removed:
Access Removed: SeNetworkLogonRight
Account Modified: Everyone
Removed By:
User Name: BOSS$
Domain: WORKGROUP
Logon ID: (0x0,0x3E7)

Going to MS KB to figure out what this means..thanks again.