I have been monitoring the event log on one of our servers (2003 R2) and there is something wierd going on. There is an account that gets enabled, and almost immediately it is disabled (within a second to a minute). The account is HelpAssistant_xxxxxx, where xxxxxx varies every time. It is happening about every hour or two. We almost never use help assistant here.