When I mount a remote drive with
net use, there's no log on the DC? I only see a
credential validation, and no idea where the request is from. (I mean, which remote share the user mounted)
Am I wrong?
Sounds about right for the default logging level in Windows OSes. To get more info, you need to increase your logging level, and audit logs are a mixed blessing, at best.