Retrieval of Message (API?)

We have a user profile (ADMIN) that is the administrator of the PC domain. 
There is one PC that copies a few web pages out of a folder on the iSeries, 
onto our PC web server. We have simply scheduled a job on the Win2K box to 
do COPY commands from our iSeries. The PC server is signed on to windows 
with profile ADMIN, so we created a profile on the AS/400 called ADMIN, with 
the same password. Beautiful...

But sometimes (usually early in the month), the ADMIN profile gets disabled, 
with a CPF1393 message (device of *N). Nobody is supposed to be using this 
profile, and since no device error comes up, it isn't caused by somebody 
trying to sign on as ADMIN...

So my question is: When I look at the CPF1393 message, is there an API that 
I can utilize (using RPG) to find out what IP address disabled the profile. 
Is there a way to 'hack' into the QZSOSIGN job and see where the offending 
box is that keeps disabling this? 

-- 
"Enter any 11-digit prime number to continue..."
"In Hebrew SQL, how do you use right() and left()?..." - Random Thought