Do you keep logs of authentication? Where I work we have logs where I can do a search for computer names with the associated user ID. It shows me that a specific ID authenticated to the network via a specific computer (or exchange or whatever). You might be able to find it that way. However, if it was a personal PC (a laptop) just using your network it probably would not show up.
Also, if you don't have this configured it won't be tracked...

jr

"What can be asserted without evidence can also be dismissed without evidence." C Hitchens