We use an incident response tool to remotely connect to another computer and generate an ARN file (running as SYSTEM).
When we pull the ARN file back to the security analyst's workstation (not the PC where the ARN was generated), the Users pull-down shows the profiles from the analyst workstation, not the source PC.
Is there a way to manually tell autorun which user profile to display (or have it enumerate the users from the ARN file, not the local PC)?