How to track administrator access, files touched and timelines

On an A/D network,  15 server ---  with several different administrator levels (administrators and then Domain adminstrators).  I have noticed that admins for H/R seems to have access to my server.  How can I track or trace -- where they accessed or looked on my server in the Event logs?
misterdAsked:
Who is Participating?
 
misterdConnect With a Mentor Author Commented:
The must be a means to track who has logged on,( maybe not what they have done),  if they installed some software and deleted something.  I will check the server auditing
0
 
JohnConnect With a Mentor Business Consultant (Owner)Commented:
I think you must turn on Server Auditing to track this kind of information and it is not available if you have not got it turned on at this point.

If the various administrators are members of the administrators group, they can go anywhere they please and look at whatever they wish.
0
 
JohnConnect With a Mentor Business Consultant (Owner)Commented:
You can look in the terminal services section of server admin to see who is logged on but you need auditing to see who did log on and what they touched.
0
 
misterdAuthor Commented:
Nothing worked for me -- had to call in someone
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.