I'm sure we all have a list of those we enjoy helping with tech problems -- and a list of those we'd rather not. Take the defensive user: someone who insists a problem wasn't her fault, doesn't offer any help during troubleshooting, and won't let it go. Yeah, fun times.
Years ago I worked for a Giant Entity in one of the accounting groups. My position was in functional support; basically, I was a superuser who supported the accounting analysts. Account/system reconciliations were key components of the analysts' jobs, so when one of the accounting systems they used went out of whack, it was an issue. One of our support functions was to help find those discrepancies if the analyst was having trouble.
One afternoon an analyst came to my desk with her supervisor behind her, frantic and complaining about a mysterious $4 billion(ish) item on one of her accounts. The item had already been processed for the correct amount but had somehow later gotten changed. It would not affect her reconciliations, but her supervisor wanted to know what it was.
This user, "Lucy," was a very nice person but not the sharpest tool in the shed -- our team spent more time with her than with most of the other users. And from what I was hearing from the supervisor, Lucy wasn't in trouble; she just wanted to know how it had happened.
Although the analysts were assigned specific internal clients, the system was set up so that they could access all of them. But Lucy was on the defensive, demanding to know how the $4 billion item got into one of her accounts. She hadn't done it, of course, so somebody else must have logged into her client's company and added the errant record.
Like many systems, this one had an audit trail for any update that included user ID, date, time, and terminal. I told Lucy and her supervisor that I'd check the audit trail and get back to them, and I tried to calm Lucy down by pointing out that at least the item was not a reconciliation issue. But even as she walked away she kept insisting she hadn't done anything.
In the ensuing quiet, I began looking into the problem. I found the transaction's user ID (hers), date (a Tuesday), time (1:07 p.m.), and terminal (her PC). I printed it out and went to show her.
She looked at it but shook her head and insisted she could not have been the one who had changed the item amount. Somebody else must have done it. To which I could only say, "I'm just telling you what the audit trail shows."