Pardon me for butting in, and probably you've already considered this, but what the heck. Do you even know that the user actually logged in during the time in question? I suppose the logs will at least let you know *if* anyone did login, but if the trouble-maker used an already logged in station you get nada in the logs. -Greg