Event ID 531 - Disabled user

You'll see this in the event log:

Reason: Account currently disabled
User Name:
Domain:
Logon Type: 3
Logon Process: Authz
Authentication Package: Kerberos
Workstation Name: WS1
Caller User Name: WS1$
Caller Domain: PCL
Caller Logon ID: (0x0, 0x3E7)
Caller Process ID: 992
Transited Services:
Source Network Address:
Source Port:

Here's the fix:

1)Log on using an administrator account on the server's console.
2) From a command prompt, enter "at [time] /interactive cmd.exe", where
[time] is some time in the near future.
3) Switch to the new command prompt that launches
4) Change to c:\windows\system32\wbem
5) Execute "mofcomp scm.mof
6) Restart the "WMI" service on the server.