8.2.2 Using Event Viewer to View Security Logs
You can use Event Viewer to view the security logs that Windows Server 2003 recorded events in. You can
also archive log files to track trends over time.
Note: You must have the Manage Auditing And Security Log user right for
the computer where you want to configure an audit policy or review an audit
log. By default, Windows Server 2003 grants these rights to the
Administrators group. Furthermore, the files and folders to be audited
must reside on NTFS volumes.