We are sometimes asked to say whether a user has accessed a particular document. File auditing for NT has a terrible amount of overhead, so it is usually turned off. Recent Documents are stored on in %userprofile%\recent. There is also the most recently used (MRU) list in the registry for each user stored in HKU\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs . My effort to query these data is EnumRecent.vbs.
It is pretty easy to read a remote folder, but reading the registry hive of another user requires you to load the hive of that user. As far as I can tell this can be done only by shelling out to run a REG LOAD command. I have had some erratic results with this portion of the code. You can check your own history, but you cannot check the history of another user that is logged on. If the registry read code fails, I pop up a message with the command line that failed. If you figure out why this happens, drop me a note.
Why do this? It is part of the continuing effort to see what files have been accessed by users to determine whether administrators have over stepped their authority, or that end users have accessed sensitive files.