Why don't you check Windows event logs on the server?

>
>I have a customer that gets the message "Your account has been looked at, please contact your administrator" on some of their machines, logging onto a MS Windows 2003 Server. There are 3 machines.
>
>This happens every Monday morning, the customer downs the server, waits, then ups it again and all is well
>
>Is this someone trying to hack in, a virus or what?
>