Lol, yeah I figured it out. There's a tool that checks if people used up all their vaca time and auto boots them off when they run out. It is continually running for people that used all 240 hours, so it keeps trying to boot them off, which part of the boot off vaca mode process is removal of protection. I'll get it all sorted out in a little bit 🙂
