Enable Security Auditing in Windows XP

Windows is capable of keeping tabs on a variety of events. You can track and log when user accounts login or when there are failed login attempts. You can track when files and folders are accessed or denied access. After a security incident, or when you suspect that there may be a security incident, this data can be valuable in determining what happened and when. The key is, you have to turn it on in the first place or you won't have any security data to review. For instructions on setting it up, see How To Enable Security Auditing in Windows XP.