We have a stand alone samba file server, no domain involved. Everyone has a share for their home drive, then there are a series of shares for different departments.? The department access is controlled by being a part of the system group found in /etc/group. My boss has had access to the "R:" drive in our environment for years then this morning suddenly he didn't have access to it, and I looked in /etc/group and his username was not under the group associated with the R: drive.? I put his username back to fix the problem, but now I'm wondering how/why was removed.? I was in /etc/group yesterday adding a new employee to two other groups and removing one old account from all shares, but I did not touch is username for anything. In /var/log/secure I only see entries for icinga server authentication, and logins for ssh sessions, I don't see anything specifically listed out where access to a given share was added / removed or where a user was added / removed from a group in /etc/group. Is there another log that would capture changes other than /var/log/secure, or /var/log/messages? -- Christopher Wensink IS Administrator Five Star Plastics, Inc 1339 Continental Drive Eau Claire, WI 54701 Office: 715-831-1682 Mobile: 715-563-3112 Fax: 715-831-6075 cwensink at five-star-plastics.com www.five-star-plastics.com