Auditing a domain

[Fred]

Do I have to audit a specific machine if I want to see if
someone is prowling the network? I want to see if someone
is trying to gain access to several machines. Can I audit
them from the domain controller?

Is there a third party application to do this?

Thanks

 

[Steven Umbach]

You will need to enable auditing of logon events on those machines to track that
activity. You can use Event Comb to scan multiple computers for specific events
as long as you have administrator rights on those computers.Be sure to also
increase the size of the security log substantially. The links below may
elp. --- Steve

http://is-it-true.org/nt/atips/atips155.shtml
http://www.microsoft.com/downloads/...9C-91F3-4E63-8629-B999ADDE0B9E&displaylang=en