As I understand it, for Windows computers the AD connector (or maybe the script for the domain controllers?) monitors logins and associates an internal IP address with a user. The virtual appliance uses this IP->user mapping to add information about ...