Good day!
I noticed some different in log.
Some users have IP address in log, some have not.
What is a different?


Mar 30 10:07:44 r1.mikrotik user admin logged in from 192.168.56.191 via winbox
Mar 30 10:09:25 r1.mikrotik user admin logged out from 192.168.56.191 via winbox
Mar 30 17:30:48 r1.mikrotik user admin logged in via winbox
Mar 30 17:32:10 r1.mikrotik user admin logged in via winbox
Mar 30 17:32:11 r1.mikrotik user admin logged out via winbox

Thanks!

Maybe those logins were using MAC connect?

Great idea!
Continue the investigation

Thank you!