I am trying to track down and fix a large number of failed logins reported
in the 'Failed logins per hour' log. The item regularly shows a bad status
in NRM as a result of this. The errors seem to be caused by a single PC
but the user logs-in from a distant location on the network, making it
difficult for me to troubleshoot. He has been accessing our server in this
way since February but the problem has only appeared in the last 2-3
weeks. I have checked his Client32 settings and all seemed OK (no Zen, no
NMAS). But every time the user logs-in, he produces 50-100 error messages
within a 2-3 minute period. The log-in is always successful and the user
hasn't noticed any problems or delays during the process.

The messages comprise of time & date, IP address of the PC and the user's
OU but not the actual user name, which makes it even more of a mystery.

I've looked for similar on this forum but those cases have not led to any
conclusion. Any ideas as to why the user's context is attempting & failing
to authenticate?