Originally posted here by foxyloxley
in light of your last reply :
You have to bounce it upwards .............

Give him some positive spin [your post was a good reference]
But let others decide the how why when and where's ......................

that way, you will have done your bit to defend him, but the company will decide whether or not to terminate .............

Why not show him this thread [abridged] give him a [last] chance ?
his behaviour HAS been good so far, it's just his curiosity ......... and we all know what THAT does [ his name's not Tabby ? ]
Just an update. I followed what most said and did my job. I informed management and my boss about the activity. I included the logs stating that the activity was only during lunch and I didn't see any malicious intent. The user was in HR for about 30 minutes and is now back at his workstation. I was thanked and he was warned.

Greenies for everyone (even though I can't give them to all?????) Thanks again for all the advice.