Are your people logging into the initial unix server from a PC?
What we do, is assign each PC a unique id. We can trace the login id via the PC id which shows up in the finger command.

Also, our system has /usr/var/adm/syslog.dated files.. which trace all root logins and what device they are coming from. You could then trace the device.


Hope this helps