See http://www.eventid.net/display.asp?eventid=577&source=security

So, is this happening for one user on different computers of for the one user on the same computer?

Is that user able to run a simple login batch script (no KiXtart at all) that only contains something like
code:
echo testing login script

pause
_________________________
There are two types of vessels, submarines and targets.