Auditing is built into Windows NT. This allows you to track which user account was used to attempt what kind of access to files or other objects. Auditing also can be used to track logon attempts, system shutdowns or restarts, and similar events. Auditing is described in Chapter 9 "Monitoring Events" of Microsoft Windows NT Server Concepts and Planning. For procedural information, see Help.