Hi...

we have an in-built tool(window 2003 sever) in OS called "Port Reporter". Using this we can get the every action in our server.

if this tool/service is not enbled in ur server enable it.

i hope this tool will help u.