Enable Failure auditing for Logon/Logoff, the logon failure event audit should show you the Domain and Computer that failed. If you can upgrade your RDP clients to the latest version it will also report IP numbers ! This may be a long job, depends on the size of your environment - if you've got something like Altiris you could deploy an RPI so it should be much easier. Mark --- bbeckett2000@xxxxxxxxx wrote: > Is there a way to see who was trying to logon as > another > user? They were using an RDP connection so no IP > address > came up. This is on an NT 4.0. The security logs > show > the attempts, are there any other logs? > > > =================================== > This weeks Sponsor: > ThinPrint > - High resolution, DRIVER FREE PRINTING with no loss > of quality in color. > - Removes print spooling and rendering tasks from > your terminal server. > http://www.thinprint.com > =================================== > For Archives, to Unsubscribe, Subscribe or > set Digest or Vacation mode use the below link. > > http://thethin.net/citrixlist.cfm __________________________________________________ Do You Yahoo!? Everything you'll ever need on one web page from News and Sport to Email and Music Charts http://uk.my.yahoo.com =================================== This weeks Sponsor: ThinPrint - High resolution, DRIVER FREE PRINTING with no loss of quality in color. - Removes print spooling and rendering tasks from your terminal server. http://www.thinprint.com =================================== For Archives, to Unsubscribe, Subscribe or set Digest or Vacation mode use the below link. http://thethin.net/citrixlist.cfm