Mark Russinovichhas done this.

Read "The case of the slow logons" at link.
http://blogs.technet.com/b/markrussinovich/archive/2010/01/13/3305263.aspx

Now you see how he did it and you can follow allow with the (free too) tools to find it.
Bob