But then he saw the time : 2:47 AM. And the user : not a name, but a SID. A Security Identifier that didn't match any employee in the HR database.
For the first time in three years, he wasn't bored.
Leo grabbed his badge. He ran past the server room toward the physical floor of Accounting. He kicked open the door.
Event ID 4656: A handle to an object was requested. *Object: C:\Finance\Q4_Pending*
"Your leash is just a string, warden. I cut it at 2:47."