Systems, methods, and computer program products are herein defined for identifying users of personal computers within a network for the purposes associating the personal computers with custodians in an electronic discovery system. Embodiments provide for a tool that accesses the personal computers via the network, locates and queries the profile list on each personal computer for user-identifying data, including network user identification, transmits, for each personal computer, computer-identifying data associated with the personal computer and user-identifying data associated with a user of the personal computer, determines matches between the network user identifications and custodian entries in a custodian directory; and, in response to determining the matches, links the computer-identifying data of the personal computer associated with the matched network user identification to the matched custodian entry in the custodian directory.