Is there anyway to be able to save off the MAC address of an user session, it's the one piece of the puzzle to figure out whom did what when in the event logs, etc. We can trace the IP address through the system but once the DHCP lease has expired, there is no way to match up the IP address with an MAC address and/or Hostname (of the device which connected). Hostname could be an option as well but not all devices provide one, everything does provide an MAC address though.