Thanks... It´s strange, ´cause when I open the ISA reports, from the 25 top users, the 1st listed is the UNKNOWN guy. The same happens with protocols (there is UNKNOWN). All users and protocols appear, but besides them the UNKNOWN appear as well. Have you had this problem before?
