I have a mac mini lion server that has a student username on it. All around the school the kids use laptops that connect to a share based on what classroom the laptop came from. It works like this.
Laptop # 32 in room 400 will connect to the 400 share folder on startup by mapping the drive with a script.
This allows teachers to use their account and see what the students have been working on. Problem is that some kids are dastardly and delete the entire folder and all of its contents. What I have been tasked with doing is tracking down the students that have been doing this.
I know this can be done with auditing but I'm not sure how to get the hostname to save in the log. I can definitely get logs, thats no problem but they don't show me from which ip address or hostname (preferred) the changes originated.