I'm seeing some strange behaviour with this report - lots of instances of
date/time entries with n\a in both the domain & user columns - when checking
the 2003 DCs that I have the forwarder enabled on I cannot see any Events 539
or 644.
Is this because the event data is somehow not being interpreted properly by
ACS ?
Cheers,
Ian