No I looked at the NTUser.dat files for the various user accounts and with the list the IT guy gave me of current/deisabled/old accounts I used the timestamps to corroborate.
Thanks again.
↧