Hi, I have SBS and E2k. I get event 1000 and 1202. I read Q279432, Q247482, Q260715. I could not found problematic user. I have winlogon.log which I got it by secedit /refresh. Any comment. Tanks Hasan Çolpan Tepum Technology Inc. System Engineer MCP & MCSE & CCNA & A+