Question : Receiving multiple EVENT ID: 1053 on Windows 2003 Server, why?

I am receiving multiple EVENT ID: 1053 errors on my Windows 2003 Standard SP1 server. I cannot locate any other servers or clients that are receiving these errors and I am trying to figure out what is causing them.

Complete Error Information:
Source: Userenv
EventID: 1053
User: NT AUTHORITY\SYSTEM
Description: Windows cannot determine the user or computer name. (The system detected a possible attempt to compromise security.  Please ensure that you can contact the server that authenticated you. ). Group Policy processing aborted.

There is no normalcy in when I am receiving the errors, there could be minutes or hours difference between when they are logged in the Event Viewer. There is no correlating errors in the System log with network access issues. I cannot find any odd symptoms or problems with the server or any of its applications, other than these error messages.

It uses a static TCP/IP setup, and the IP, DNS, and WINS are all set correctly.

Basic run of netdiag came back clean, except for one odd warning:
   NetBT name test....:Passed
   [Warning] You don't have a single interface with the <00> 'workstation server', <03> 'Messenger Service', <20> 'WINS' names defined.

Attempted a gpupdate /force, and the Application log registered a 1704 Information entry that the GP was successfully applied. (Event ID 1704, from SceCli).

The system is running following applications:
Exchange 2k3 (for Workflow)
Syteline ERP
Terminal Services

Anyone have any ideas?

Answer : Receiving multiple EVENT ID: 1053 on Windows 2003 Server, why?

I've discovered the solution. In this case, as noted I had TS running on the machine. I noted there was a user still logged in, yet disconnected in the TS Manager. This user account had been locked down a few weeks ago, approximately the same time I noticed the errors. After forcing a logoff of the account from the server, the messages stopped appearing, and have not appeared for several days.

I will be requesting the question be closed by a mod.