Is there a way to not allow a user to change the context on their machine? Second question, is there a log file that can tell you what files were accessed and by whom?
