how can i?

how will i know if our pc consultant is changing the directory of our server? or someone is sabotaging our server by remote access? or accessing through network?