Well, I do know that if you put the /INTERACTIVE switch with the AT command, it will then build the job and have it run under the authority of the locally logged in user. So, if you can run this from a machine logged in as the user account you want to audit, then adding Interactive will run it under that context. That should do it for you.
Now, the only other thing I can think of to do is to build a BAT file with the commands you want to do, but in the BAT file, use the RUNAS command, and specify the user to run each command as.
For example, a BAT file like this
@echo off
runas /user:MYDOMAIN\JOE NET USE x: \\server\share
runas /user:MYDOMAIN\JOE copy x:\file.txt x:\file2.txt
runas /user:MYDOMAIN\JOE net use x: /delete
EXIT
That should map drive X: to \\server\share under the security context of MYDOMAIN\JOE user account. It then makes a copy of the file x:\file.txt in the same directory and calls the copy file2.txt. Last, the drive mapping is removed. All 3 steps happen under the security context of the JOE account, no matter what account the machine is logged in as.
If you were auditing file creation on the \\SERVER, your Security log in Event Viewer would show JOE doing the file copy. Not another user.
Give that a shot.
