NOTE: To audit domain logon activities and account management activities, you must use the Group Policy snap-in to enable the Audit "Account Logon" and "Account Management" settings in the Audit Policy.
To enable local Windows security auditing:
1.Log on to Windows with an account that has Administrator rights.
2.Ensure that the Group Policy snap-in is installed.
3. Open the GPMC(Group Policy Management Console) in Windows 2003 servers.

4. Navigate to "Default Domain Controller's Policy"(GPMC -> Domain Controllers Container -> Default Domain Controllers Policy)
5. Click on "Edit".
6. Navigate to "Audit Policy" node, "Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Audit Policy"
7. From the right pane, double-click the policy that you want to configure (enable/disable). This will bring up the `Audit system events properties' dialog.
8. Configure "Audit account logon events", both "Success" and "Failure".
9. Similarly configure "Audit account management".

This policy setting will be replicated across all Domain Controllers which enable auditing of the corresponding activities.