Hello, My problem is: Someone has change the gateway on active directory and after clean the logs. But i installed snare, and i need to find who do the change. Everyone connect to the server - Terminal Services Has anyone log to locate the user who made this? Best regards.