If this is an Active Directory domain, you can indeed monitor user activity.
There are nine security categories which can be configured to generate events depending upon your auditing requirements:
Audit account logon events ? this category will generate a success or failure events whenever a domain controller receives a logon request.
Audit account management - this category will generate a success or failure events whenever a user account or group is created, renamed, changed or deleted. This includes the creation of events when passwords are changed, and user accounts are enabled or disabled.
Audit Directory Service Access - this category will generate a success or failure events whenever an Active Directory object is accessed/changed. This category will generate events in another event log which is only present on Windows 2000 Domain Controllers.
Audit Logon events ? This category is separate from the "Audit Account logon events". This category will generate a success or failure events when a user logs in or out of the system. Events are also generated when a user connects or disconnects from a system via either an interactive type of logon, or via a network type of logon.
Audit object access - This category will generate a success or failure events when a user specified object ? file, directory, registry key, printer - is accessed or changed.
Audit Policy Change - This category will generate a success or failure events when a user makes high-level changes to the security policies. These changes may include anything from changing user rights and privileges to changing audit policies.
Audit Privilege Use - This category will generate a success or failure events whenever a user makes use of certain administrative privileges which you may have assigned to that user.
Audit Process Tracking - This category will generate a success or failure event whenever a process is launched, a handle to an object is duplicated, objects are accessed indirectly
