Security Password violation?

Hi, quite often one of our people gets his User disabled... I've
activated
Auditing, and after any of these occassions I can see (DSPAUDJRNE  with
type PW) that there were some attempts to use his userID and a failing
Password.

But the audit journal entry gives no more info than date and time...

Joblog for job QZSOSIGN also gives only
 Message ID . . . . . . :   CPIAD06       Severity . . . . . . . :   10
 Message type . . . . . :   Information
 Date sent  . . . . . . :   19/11/01      Time sent  . . . . . . :
13:24:12
 Message . . . . :   Password not correct for user profile.
 Cause . . . . . :   The password received for user FERNANAN was not
correct.
 Recovery  . . . :   Correct the password and try the request again.

I'd like to see, at least, the IP address the intent came from, maybe
even
the userID that was signed to Windows at the PC the request came from...

any additional info that can enlighten the path to find what's going on.

Maybe it's even the user himself doing something wrong without even
knowing
it! But how to get to know it if there si such small info.

I've considered writing my own ExitProgram for the SignOnServer, but was

hoping there'll be a direct way of getting that info without having to
reinvent the wheel?
-------------------------
Antonio Fernandez-Vicenti
afvaiv@wanadoo.es