Procedures for Tracking Unauthorized Access Attempts on Your WinXP/2000 System/Workstation:

Step 1. Setup Auditing:

Click Start.
Click Run.
Type in MMC.
In Console Root, Select File, Add/Remove Snap-In.
In Add/Remove Snap-In click Add.
In StandAlone Snap-In scroll to Group Policy and click Add.
In Select Group Policy Object, leave local computer and click Finish.
Close this window.

In Add/Run Snap-In, click OK.
Expand Local Computer Policy.
Expand Computer Configuration.
Expand Windows Settings.
Expand Security Settings.
Expand Local Policies.
Expand Audit Policy.
Click Audit Policy.
Double-click What You Want.
Check both the Success and Failure boxes.
Double-click System Events.
Check both the Success and Failure boxes.
Close this window.
When prompted to Save Console Settings to Console 1?, click Yes, and then click Save.

Step 2. Display the Event Viewer:
Click Start.
Click Programs.
Click Administrative Tools.
Click Event Viewer.
You will be able to view a list of unauthorized attempts made against your workstation.