tech_guy,
I believe when you first launch psShutdown it presents you with a EULA screen (much of the software, if not all, made available by Sysinternals acts in this manner). Because this screen is only presented to you when you first launch the application this may mean that it stores some value in the users registry acknowledging that you had agreed to the EULA. It may be possible for you to track down this registry key and then somehow search the registry of all 109 users that you have identified. The last part is a BIG job, but there's probably some way of automating it. If it worked (no guarantees) it would at least tell you what user had at some point launched psShutdown which would probably violate your AUP.