How could I audit Domain Admin account logon of DCs ?

Please refer to this: Audit logon events http://technet.microsoft.com/en-us/library/cc787567(v=ws.10) Regards, MiyaMiya Yao TechNet Community Support

Thank you for your reply. Unfotunately I could not follow the link you wrote.

Try this: http://technet.microsoft.com/en-us/library/dd408940(v=WS.10).aspx and look for the section "To configure an advanced domain logon audit policy setting". Cheers, Ramin

Thank you. I saw advanced domain logon . There are AccountLongon, LogonLogoff,PrivilegeUse,etc. Which policy is suitable for Domain Admin Usage audit, and which event ID is created when Admin logon ?

Based on my known, when you enable the logon audit policy, all the user logon events would be audit, including the Admin logon. Regards, MiyaMiya Yao TechNet Community Support

Based on my known, when you enable the logon audit policy, all the user logon events would be audit, including the Admin logon. Regards, MiyaMiya Yao TechNet Community Support