Accessing $ Share

Scenario:

If there are multiple administrators in a organization and everyone knows the Administrator passwords of the End Users Desktop.

If one of the admin access a remote PC by mapping the Drives with in the network and copies confidential files without users knowledge.Can this type of activity be tracked?


Please clarify.

Regards
Benny

The accessing of the remote shares is logged in the security log in event viewer of the remote PC. I don't believe the accessing and copying of files from the remote computer to the local computer is logged unless you enable additional auditing on the remote PC. We had to analyze the event viewer of a remote PC a while ago in an "investigation." Using other strategies we were able to theorize that the user did send himself some docs by email.