I am looking at the logon failure report from last Sunday. We have an exemployee showing as trying to logon from outside the company with 96 individual failed login attempts. It appears that many of the failed logins are duplicate events based on on the time of day shown. My question is were there 96 individual seperate login attempts? Can we customize the report to summarize the events to show only the original login.

Any thoughts or suggestions you offer are much appreciated as we are 2 weeks into the instal of EventLog Analyzer #5 and wish to make the best use from the reports as possible.