Troy,

> I was wrong,  Remote Desktop on XP uses Type 10, while in 2000 it would use
> Type 2.  The only other mention I found producing this error was logging in
> through a KVM IP switch.  I don't suppose that workstation has had one of
> those installed.

Thanks, that's what I was looking for.  Of course, that workstation does not
have a KVM IP switch.  So the evidence for a physical break-in is looking
pretty solid.  I suppose I could reformat and re-install, but if the
intruder is getting through 4 locked doors and cracking passwords, then
reformatting, etc. is just a waste of time.  Looks like it's time to go to
video surveillance.

-- David McFarlane
  Systems Designer
  Michigan State University, Dept. of Psychology
   [log in to unmask]