On our development W2K3 box we sometimes run out of space. I use SpaceMonger to map out where the space is being used and have sometimes found large hunks of junk in a users recycle bin. Now it’s just a matter of finding out who. SpaceMonger will show a path like:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-1384440006-404362789-3620623192-2690
But to determine the user, you must go to the registry (HKLM\Software\Microsoft\Windows NT\CurrentVersion\ProfileList) and look for that SID in the ProfileImagePath.