I'm pretty far into researching my event 1202 SceCli and have found that my offending user (used "
FIND /I "Cannot find" %SYSTEMROOT%\Security\Logs\winlogon.log") is called "performanceloguser". However performanceloguser doesn't show up as a user in my AD. What should I do next?