This is my first post here, I've usually found the answers to my problems / questions just by searching and lurking but this one is beginning to irritate me so hopefully someone here can help.
2 Days ago the "Office14" folder (location: c:\Program Files x86)\Microsoft Office\Office14) started appearing after users log into Windows 7. It's not in the startup folder and it's not in any of the login scripts, it's doing it for every user on every machine on the network, be it admin, staff or student. It doesn't happen on the local admin login so it's network login related.
Has anyone had this happen before? I'm thinking it's not actually anything to do with Office itself, I have a feeling it could of happened to someone else but with a different folder opening on startup. The machines are locked down pretty tight, we're a special school so what students can do on the machines with a student login is pretty minimal although something always inevitably slips through I suppose. I've been trying to figure it out for 2 days now and I'm out of things to check.
Is there a tool that will let me log all of the events that happen during the login procedure, I don't mean event viewer (unless someone knows how to get it to tell me why that folder is opening) and enabling boot logging in msconfig is no help either as it doesn't log events like this.
Any suggestions would be greatly appreciated before this sends me completely bonkers.