Some more ideas...are Remote Desktop/Remote Assistance enabled? Maybe
someone is clandestinely changing the workgroup name back...check Local
Users and Groups for unknown admin-level accounts...change the admin
password in case someone unauthorized is coming in at night to access the
machine...enable auditing for Account Logon Events and Logon Events to keep
a trail of who is accessing the maching using the Administrator
account...monitor the Workstation service on the machine because this
service is the event source for System log events indicating that a machine
has joined a workgroup...enable auditing for Privilege User and filter for
all events having ID 577 as these events indicate the current domain or
workgroup name in the Primary Domain field, that way you can try and
pinpoint the exact time when the workgroup name changes back...
--
Cheers,
Mitch Tulloch
==========================
Author, Trainer, Consultant, Nerd
http://www.mtit.com
This posting is provided AS IS with no warranties and confers no rights.