The MMP provides you with the option of pre-authenticating users by binding to the directory as the incoming user and logging the result.
Enabling user pre-authentication will reduce server performance
The log entries are in the format:
date time (sid 0xhex) user name pre-authenticated - client IP address, server IP address
Where date is in the format yyyymmdd, time is in the time configured on the server in the format hhmmss, hex is the session identifier (sid) represented as a hexidecimal number, the user name includes the virtual domain (if any), and the IP address is in dot-quad format.