Originally posted here by Lv4
The only jobs happen at around midnight when it copies the logs to a central server and starts a backup, both of which finish by 01:30. The LOCALHOST failure is always at the same time, and as I said the dev in question doesn't have access to that box so I don't know why a process would be trying to log in as him. If I remember correctly, when a process fails a log in it doesn't just stop at one time because Windows is fairly aggressive with retry attempts.

Also if it is the local box that is attempting to run a process it should show up with the local box name, not LOCALHOST. I see plenty of services running on that box in the logs and they all have the real machine name there but only one entry for LOCALHOST. As I said this is a stumper for me

it happens every morning at around the same time, I'll have to verify the time but I know it is usually around 06:30ish. The only variance that I have noticed is on Sundays and it happens twice then, back to back.
Has the "dev" in question, developed an application for another environment / box which either on purpose or by accident got migrated to this box? What type of apps. does he/she work on and is there anything that he/she has worked on running on this box. I have seen more than one developer write "Backdoors" into their code, I have also seen them hardcode their personal userid's & passwords into their code in order to debug.

Cheers: