If law enforcment can order to log IPs, could they tell Microsoft that there is an Windows user with specific e-mail address (which that user uses as windows lo

If law enforcment can order to log IPs, could they tell Microsoft that there is an Windows user with specific e-mail address (which that user uses as windows login) and order them to deploy Microsoft signed update only to that user devices with embedded trojan written by some three letter agency ?