If you look at an Event Viewer Event ID: 12 report is there any information in a report to enable you to determine whether the user logging on has Administrators rights or is a user with lesser rights?
TIA, Gerry