Suspicious Login Attempt

[Robert]

Is there any way to monitor logins on the network from an
outside source? We do not have a RAS server, but do have
a modem connection. I need to be able to monitor who and
when someone logs onto the system from the outside. I
also need to be able to do this undetected for a short
period of time. Is this possible?

 

[Chriss3]

You can track the Source IP Address on logons with Auditing.

 

[Robert]

I will need to do this without detection... Is that
possible.

The reason, to be specific is that the IT Manager claims
that he is "working from home". HR asked me to verify his
whether he is actually working from home as he says...

I told them that we don't have an RAS server and don't
believe there is anyway that anyone could be coming into
our system, but my mgr claims "he is"... So, I want to be
able to prove that "no one" including him is actually
logging on from an outside source.