Maybe this is a feature request more than anything. Anyone has been able to figure out how to get the username of the infected computer emailed along with the notification. KB Solutions ID: SOLN58 shows the available environmental variables, however username is not one of them, they say to use anything available running the SET command. I tried this and my case using %USERNAME% returns "NT AUTHORITY\SYSTEM" In a large network with hundred of nodes over 5 servers, a netbios name becomes pretty tedious to track down. Even an IP address would help, as then I would know which subnet i can start looking at. Thanks.