You can trace CIFS logins by monitoring any attempt by an NFS client to obtain a CIFS credential.
Use CIFS login tracing carefully because it reports every CIFS login. Persistent use can result in excessive console and log messages, which can affect system performance. By default, the cifs.trace_login option is disabled. The option should only be enabled temporarily for diagnostic purposes. Keep it disabled all other times.