What does golden ticket mean here? Is some kind of microsoft credential? you should be able to detect any kind of leftover account. a backdoor would seem be better.

and on this whole area, i would not encrypt someones machine - unless you are trying to scare someone, it would be better to have never known.