[ActiveDir] Account auditing

[Mike Hogenauer]

So I have a user who I think is trying to gain access to places he’s not supposed to be, I’m looking for a good way to audit this account, I have auditing enabled on account and object access and I view all my security logs but I’m really trying to target one user account in particular and get a good detail report.   Does anyone have any good suggestions on how I can monitor and even get alerts on one account whenever it does anything on the network, without having to sniff packets and watch ports?   Thanks!   Mike