Your statement "connects to" is a bit vague. I suspect you're talking about an Administrator using either built-in or third-party administration tools and not simple TCP connections to the clients.
There won't be a whole lot unless something was done. Simple TCP/IP access isn't logged by default. The main things you'd be looking for are changes to the filesystem and records in the event logs.
Most of the "traces" you're going to find would be in the Security Event Log. In a stock Windows XP machine there wouldn't be much of anything logged because, by default, no auditing was enabled in any version of Windows XP. On the Windows Server 2008 and Windows 7 machines the defaults are expanded (though I don't have a reference handy at the moment) and I believe you'll see some successful access attempts, as well as failures, by default.
As an aside, "Audit Policy" is what you're looking for to configure computers to audit for this kind of thing in the future.
If there was an interactive logon then you'll have a slew of events in the Application Event log in any of those versions of Windows.
Depending on the level of auditing you've got enabled on your domain controllers you might see events in the Security Event Logs on those machines showing logon events to the client computers. A logon event would be generated any time an domain account was used to access a service that uses domain authentication on the client (built-in remote administration tools via RPC, connecting the file shares, interactive logons).
If the "Administrator" used a third-party tool ("LogMeIn", "VNC", etc) then there will probably be logs in the Application Event Log.
If the NTFS filesystem is configured with default settings the last access times on files will be "bumped", but you'll probably trash any evidence if you go bumbling around trying to look at that w/o taking precautions. Obviously, if any files were modified or created and steps weren't taken to cover the tracks then there will be creation and modification time changes, too.
In the scenario you describe in your question, depending on the OS versions at play, you might see events in the Security Event Logs on both the Workstation2 computer and Active directory Server1 showing the network logon events associated with the filesystem access. If Workstation2 is a Windows XP machine with stock settings then you'll see nothing there.
