I doubt very much that the logon script is changing the timestamp. Run the script with debug on and watch the timestamp as you step through it.
I am not familiar with the audit software, but I suspect that it is configured to run on every boot. Look for installed services or check the reg for entries in Run and RunServices under HKLM.
_________________________
Give a man a fish and he will be back for more. Slap him with a fish and he will go away forever.
