I'm wondering if there is anyone that I can find out who did update on a user account in AD without going through event logs?
Something like a batch file or vbs should be ok.
The Security Event Log on the domain controller where the modification occurred would be the place to find the information you're looking for but, unfortunately, there isn't enough auditing enabled by default to give you the information you're looking for. In an after-the-fact scenario like this you're probably out of luck if you didn't already have auditing enabled. For the future consider enabling auditing for the types of events that interest you.
If you do have the right auditing enabled then you might consider exporting the event log to an XML or text format and rifling through it, at least initially, with something simple like