I have another department logging onto a server without authorization. I want to determine if they added a feature without following the proper procedure.
You can use Event Viewer for this. Open Event Viewer, then expand Windows Logs, and click on Setup.
You'll want to create a filter that looks for these keywords: Microsoft-Windows-ServerManager or just ServerManager or Event IDs 1611 & 1610. Preferably filtering for the event IDs.
Example of Features added screenshot in the Event Viewer on my lab server: