I just had another thought. A few years ago I had a couple of workstations that kept getting intruder lockouts throughout the day. I found that the problem was CIFS and/or NFS on the Netware server. I have no Macs or Linux workstations accessing the server, and all Windows workstations use the Novell Client to connect, so no need for those protocols.
I disabled those protocols in the autoexec.ncf script on the server, rebooted, and the problem went away. I understand that there is a registry hack you can do on the client side to only force the client to only access the server using native protocols, but I think managing it on the server side was easier.
