Solution: Tracking down a user in a large AD network

All,
I've found the solution, thanks to a friendly fellow on the list.
The key event is 680 on the domain controller.  It records the
name and source machine for each logon.

Thought it might benefit the list!

-Ds