The logon script might be a task triggered through Task Scheduler. That's my final guess.


tomcolgan said:
Found nothing, would you know what the script file is?
It's likely either a .bat or .vbs file (more likely .vbs). You can try searching the entire user's home folder for these file extensions with the following command. (Added in .js and .ps1 script types just incase)

Code:
dir "C:\Users\%USERNAME%\*.bat" "*.vbs" "*.js" "*.ps1" /a /b /s
I doubt you'll find any script though. Might have to give the person who set up the user accounts a ring.