Hi! I prefer to see SID in access.log records instead of domain\username pair, for ntlm-authenticated connections. How do I get this feature? Reason is obvious IMHO - SID is real unique ID in this case and its easier to interpret, but parsing username sometimes produces mistakes. thank you forward, Andrej Surkov