Some strange things happened. We suspect that user from time to time copy all files to some place, do some action, print report and then copy back all files, of course without saved action. Idea is to save all his work to some place where he does not have access and later review his actions.