Open Connections to the DC's

I have been seeing a select group of stations keeping an open connection to the Domain Controllers, but don't know why. Virus? Security concern? It seems to be a fairly consistent group of Windows 2000 stations, 14 stations out of the entire domain. All stations are imaged before going into the field. Any ideas?
Thanks!
 
Back