Failed admin logins

["Joe Quigley" <jquigley () iir-central com>]

Hello,

I have a machine that is trying to log in as the domain administrator
but can't figure out what application/service is doing it. I've checked
all the services that login as administrator (yes, very bad idea to use
admin for services, I inherited this setup) but that does not seem to be
the problem as the services start. I even retyped the password in the
services applet just to be sure. Anyone have any thoughts on how to
track down the source of this rogue login??

Thanks in advance,

Joe