query all the DCs for the logon events for that user id. (not an easy method)

have your logon script log userid, wksta, IP, mac, and timedate to a file
_________________________
How to ask questions the smart way <-----------> Before you ask