When I run a report, either with a third party tool or with the native report generator, I get 3 different types of entries for users: "domain\username", "username", or just an ip address. What is the difference between these? Is there any way to get ISA to just log entries with either just "domain\username" or "username"? I've checked the "Ask unauthenticated users for identification" box on the outgoing web requests tab, but still get all three entries. TIA. --Scott p.s. for those interested about my last question regarding installing the snap-in, it just worked the next day.