Yeah these are full machines (not virtual) with no cloning.  I thought of group policies, but the one server that was affected a month ago was not receiving the same policy as the server today, but will have a look and compare between the 2. thx