In particular...Maybe the netuser.ini file. It seems to get updated when somebody logs in.