I think that there are only 2 possible account candidates: the user account of the person logging on or the SYSTEM account. My gut feeling would go with the SYSTEM account. Anyone care to offer an alternative suggestion? Edit: After much Google-ing, it seems that Startup and Shutdown scripts certainly use the SYSTEM account, so maybe a Logon script uses the account of the person logging on; hence the name?