You will need to look at the events on each computer, unless you purchase a third-party event log aggregator. Or, if you can wait until the end of year, Windows Server R2 will include the Microsoft Audit Collection Service as an integral part of the software release. You'll need a new license for that, though.
I agree that this should be easier than it is.
Dig deeper on Windows legacy operating systems
Have a question for an expert?
Please add a title for your question
Get answers from a TechTarget expert on whatever's puzzling you.