New
#11
The logon script might be a task triggered through Task Scheduler. That's my final guess.
It's likely either a .bat or .vbs file (more likely .vbs). You can try searching the entire user's home folder for these file extensions with the following command. (Added in .js and .ps1 script types just incase)
I doubt you'll find any script though. Might have to give the person who set up the user accounts a ring.Code:dir "C:\Users\%USERNAME%\*.bat" "*.vbs" "*.js" "*.ps1" /a /b /s