A couple things you might be able to try, but almost no chance of doing more than eliminating one or two of the possible devices you listed.
OWA will have an information log entry for the login event.
Devices connected via Active Sync show up in OWA. Even then, if someone did it on purpose, they would be able to remove it.
All really pointless though, as it won't prove anything.
Scott's right, the only way you are going to get close to a solid answer on this is by having an unreal level of logs, which if you had, you probably wouldn't be asking here.
__________________
"Wake up, Luigi! The only time plumbers sleep on the job is when we're working by the hour."
|