Hello, you can try to activate the C2 Audit level, i found thes informations on this article :

Basics of C2 Auditing

By Dinesh Asanka, 2004/11/03

Audit your Servers

What ever...