For some reason I get an awful lot of ChangeDomainMember events stating: Computer account "DOMAIN\PCNAME$" changed "-".
The insertion IP is from one or the other of our DCs.
Any ideas what causes this? Is it something I can just eliminate out in the filter?