I found the issue with the machine. After re-imaging and letting him have the machine back it started happening again. It turned out to be an on-line backup program he installed called "MiMedia" which monitored that directory. As soon as I removed it everything is fine.
Thanks for all your help
Thanks for all your help