Hi guys I need some quick help.

I have an enterprising high school student that logged into a XP PC in
the media center and changed the homepage to a bomb threat. Is it
possible to rack the user to a Username. I have the PC that had the
homepage changed. This is a cisco network, is there anyplace in Cisco
land to track this?