On teh report the CLIENT IP is shown as the DC rather than the actual Client's IP address, this is confusing and it appears that users are trying to logon to the DC console rather than from their PC.