Can't really test this as I'm out of the office this week, but I'm sure someone will correct me if I'm wrong...

I would have thought that you could read the last modified time of the ntuser.dat file to get that info.
_________________________
================================================
Breaker