I'm new to this group, and totally new to ISA. What I'm trying to do is get some traceability for terminal servers, the IIS logs only show the IP address of the terminal server itself, and not who started the web session. Can ISA do this or am I going in the wrong direction. Thanks for your help. Lamar Morris LamarMorris@xxxxxx