Check for additional files in useraudit
Add UID 0 check to useraudit