The log, made on Windows NT Event Log, looks like this:

Time: Wed Nov 21 09:37:00 2001 User: MARCUS Agent: metaframe2 .. WinStation: ICA-tcp#245 Session ID: 245 Client Name: STATION2 Client Address: 192.168.0.44

In a incident investigation this is a problem for trace-back the suspects.

Quiet simple - and. Why its false. Looks good - or is that the servers ip? Michael