Thanks for the reply. To give some better insight. This is a LARGE corporation laptop system that was out on travel. Employee are requested to use VPN immediately for all activity, but CAN access unfiltered internet etc if they do not login to VPN. It is unclear at this time if the employee was VPN connected the whole time, part of the time, or not at all. This event likely occurred while off-campus at a hotel. My only thought was to see if the MAC address was not spoofed and shows that it connected to a MAC of an unknown manufacturer.
Thanks,
JD