I've been asked to track through the system and find out from the logs when a user has logged on and off since 15th. September. I'm also increasingly getting requests to find out what files have been modified by particular users, etc. Can anybody recommend how I would go about monitoring all the network activity, and if there's anything I can use to search through the volumes of activity that would be generated? Also, are there any settings that aren't turned on by default in SBS 2003 that I could switch on?