Event IDs 4097 and 4096 are listed in the Windows Event Logs at 4 AM on a Windows 2003 Small Business Server.
In the Application Log of the Windows event viewer there are the following errors reported by secars:
Symantec Endpoint Protection stops "secars" to allow the Exchange maintenance cycle. The Exchange maintenance cycle starts at 4 AM by default on a Windows 2003 Small Business Server.
This problem is fixed in Symantec Endpoint Protection Manager 11.0.2000 build 1567.
For information on how to obtain the latest build of Symantec Endpoint Protection, please read the following document:
Obtaining an upgrade or update for Symantec Endpoint Protection 11.x or Symantec Network Access Control 11.x.