I have a small network with a couple of Windows XP machines experiencing random reboots. When the computer restarts, it comes to the login prompt with 'admin' in the username field, even though the user hasn't logged in as admin.
In my security logs on the server (Windows Server 2003) I noticed a lot of failed login attempts as Administrator. This obviously does not look good.
How can I track down and identify these login attempts? One of the machines has an out of date anti-virus (but that is about to change as I type this), but the other one has regularly been using and updating Norton.
Is there some know network attacks that look like this?
Also, how could I identify these login attempts from the workstation? Would there be a particular process running?