Thanks for the link. It was informative.
If I read this correctly I am still at square #1. 🙁
Fron the Article:[Read more]
To recap just for a moment, when Fred logs on at his workstation for the
first time that day, the domain controller that handles that logon will log
event ID 672, closely followed by an event ID 673 where the Service