Tracking down a user in a large AD network

All,
First, forgive the x-post. I'm not sure, based on list volume, that anyone else is subscribed to the IH list =). I have quite the dilemma on my hands. I work on a pretty large AD domain with nearly 100 domain controllers. We recently had an OU with about 5000 users deleted from the directory. I know the name of the user, but.... it is a shared account. (I know, but with over 100,000 users, these things slip by)

What I need to do is track back to the workstation that was used for the login, and I haven't had much luck. I'm focusing on event 673, but I'm not sure this is the right angle. Any ideas??

TIA,
-Ds Received on Thu Jul 24 17:09:07 2003