Auditing a user from W2K Advance Server

Auditing categories are turned on and off with Computer Management.

The event categories that you can choose to audit are:

Audit account logon events
Audit account management
Audit directory service access
Audit logon events
Audit object access
Audit policy change
Audit privilege use
Audit process tracking
Audit system events

If you choose to audit access to objects as part of your audit policy, you must turn on either the audit directory service access category (forauditing objects on a domain controller), or the audit object access category (for auditing objects on a member server). Once you have turned on the correct object access category, you can use each individual object's Properties to specify whether to audit successes or failures for the permissions granted to each group or user.