Look like there is maybe someone trying out scripts that needs to be blocked:

https://serverfault.com/questions/103129/leave-windows-session-logged-on/141939#141939

Noticed it since they are responses to my question. It stuff like:

"asdasdasdasd"