Logon Time Descripencies

[MISSBHC]

Hey everyone,

In my School District we've noticed some odd reports for users stating they had logon at times when the individuals are not at the School and even weirder these are at night time usually around midnight to early in the morning. These computers are being shut off by group policy at 6pm every night and no one else has the users password (admin account). This has happened to three people on seperate machines and it happens every day it shows up in the user profile logon time every day updated with new info from the night before. Has any one seen something like this before?

Thanks in advance.

[Hemoco]

I could think of 2 things.
1) your waitqueue is really long and it takes hours to do the scan.
2) some service is running under the user's account

[MISSBHC]

As far as we can determine they are not running. And even if they were running at the times listed the user that it claims is logged in is not even at the office at that time. In fact no one is in as it says they are logging in a 12 at night.

[Hemoco]

Are their computers still running at the time of the scan?