I found a guide that teaches, through turning on the Audit of the System Log on Activity via gpedit.msc, how to read the logon activity via eventvwr.msc
Is this way of monitoring fully comprehensive?
I have some doubts about it. For example windows doesn't give a chance to log a remote desktop conn. logon activity, maybe I'm worng but it doesn't seem included here.
Do you have any hack to really check if the system was used? Always thinking I've the Admin privileges, I have an I idea to implement a sort of hidden batch that could make the log for me... is there something like this around in the net?