Hi Dariusz,
The profile is really basic, no TLS and no AD integration, just user name and password over http. We have the 48 mini desktops in a secure room about 3m from the ground. People connect to these machines using thin clients and Citrix. It is possible that someone is messing around changing the passwords but I don't think so. These machines have been doing this from the start of configuring them and even before they have been deployed to the server room.
Other workstation models don't seem to be having the same problem but it is difficult to confirm as you only find out when needing to access them. I have written a script to check the 40+ machines in the secure room that we can still connect but not for other machines.
Is there anything else I can try like add a second admin user to see if it is just admin that is becoming de-authorized?
Thanks and kind regards
Duncan