Dave,

>I don't have the machine in front of me at the moment but IIRC we see security events when we switch the Run As to invalid credentials.

I would ask your customer to export all 3 of their NT event logs and send them to you. I've had similar (but not identical) "strangeness" happen and the NT event logs were the key to tracking down the problem.

Good luck!

Malcolm