What is the source of the grinding attacks? This will tell you for sure that the attacks are coming from the inside or out. I'm assuming that they are coming from outside. Again, I am able to enumerate an AD controller via RPC calls using the information you've provided.

Anyone else want to attempt this for this poor guy? I can't because of certain Govt. regulations (as most of you are aware).
--TH13