Hi, I am monitoring user account changes [password resets et al... ] but noticing "Caller Logon ID 0x0 0x3E7 & anonymous logon" I know this is help desk resetting a password via and AD Users&Computers MMC snap-in, but do not know how to prove the member of staff that is resetting the password. Help...... Fizz