Great idea Sergey

>Why don't you check Windows event logs on the server?
>
>>
>>I have a customer that gets the message "Your account has been locked out, please contact your administrator" on some of their machines, logging onto a MS Windows 2003 Server. There are 3 machines.
>>
>>This happens every Monday morning, the customer downs the server, waits, then ups it again and all is well
>>
>>Is this someone trying to hack in, a virus or what?
>>