So a user says he went out to lunch and afterwards could not log into his PC. It just hangs whereas it actually does log in in safe mode and other accounts like my admin on the domain also can log in.
I checked the start up processes ran some utilities and later a system restore: Nope Repair startup: No dice Tons of scans for malware, rootkits, virus, nothing.... Nothing suspicious in the startup programs when I checked in safemode. Other than a recent windows update in the morning, nothing unusual.
He logged in fine on another PC since we use roaming profiles with no issues.
I need to alter his permissions in AD tomorrow so I can actually check the system/event logs on that specific PC but I could use some help in pointing me in the right direction.