Pardon me for butting in, and probably you've already considered this, but what the heck.
Do you even know that the user actually logged in during the time in question? I suppose the logs will at least let you know *if* anyone did login, but if the trouble-maker used an already logged in station you get nada in the logs. -Greg -- To unsubscribe from this list go to the following URL and read the instructions: https://lists.samba.org/mailman/options/samba
