I have seen this many a time. Your issue is QLMTSECOFR
It restrict users with authority to change security and control objects to certain workstations. This prevents these users from signing on to workstations in remote locations without your knowledge
More detail can be seen
here