A method, apparatus, and computer instructions for identifying
unauthorized users. User actions are monitored in an audit for an
indication an unauthorized user logged into the data processing system
with a valid user identifier and a valid password. An action is initiated
in response to an indication of an unauthorized user.