I have a system running NT4.0 Workstation which is supposed to have NO remote logins on it (it's a compile machine for our application); the only access is supposed to be from the console.

The machine is part of an NT Domain.

The only account in User Manager is the Admin account (which has been re-named). The only accounts in ANY of the groups are that Admin account and my domain account.

However, I still see occasional logins in the Security Log like this:

Logon/Logoff 538 <user> <workstation> User Logoff:
User Name: <user>
Domain: <domain>
Logon ID: (0x0,0x2D836D)
Logon Type: 3
Privilege Use 576 <user> <workstation> Special privileges assigned to new logon:
User Name: <user>
Domain: <domain>
Logon ID: (0x0,0x2D836D)
Assigned: SeChangeNotifyPrivilege
Logon/Logoff 528 <user> <workstation> Successful Logon:
User Name: <user>
Domain: <domain>
Logon ID: (0x0,0x2D836D)
Logon Type: 3
Logon Process: KSecDD
Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Workstation Name: <remote workstation>

The user name in question is NOT my user account. The total login duration is usually less than a minute.

What else do I need to do to prevent remote logins (aside from telling this user to stop :-)) )??

TIA . . . .

Dan