Microsoft® Windows® XP Unleashed

Monitoring User Activities

One good reason to have a separate account for each person who logs onto a computer is that you can use each person's username to track individual activities. If everyone uses the same username to logon (such as Administrator—a really dumb idea), then you have no audit trail to use for tracking down who, where, when, and what happened to your computer.

To track events on the computer you can do the two following things:

• You can set up the events to track in a process called setting up auditing.

• You can use the Event Viewer utility to review the events that get written to the audit files.

To set up auditing, use the Control Panel to bring up the Local Security Settings dialog box on your Windows XP computer, as shown ...