In "Tracking Logon and Logoff Activity in Win2K," February 2001, I explained how you can use Windows 2000's Audit logon events audit category to track local logon events on your server or workstation. ("Related Articles in Previous Issues," page 58, lists other articles relating to event-log tracking.) This category captures logon events on the local system on which the logons occur, but tracking a large network's logon activity one system at a time is impractical.

Win2K'...