Log all changes to a server? Is it possible or what do I need?

We have a great scenario where the powers that be let a few people use the
domain admin username and password, then when something breaks they like to
blame anyone else.

I however can put on any product i want or turn on any auditing to track
system changes. So although the administrator name would be used, I would
love to be able to find out what IP that log in came from as well as if a
network card setting, regedit, install/uninstall of software, etc was done to
the server, any + all that I can log would be great.
If I have to get a product I will, but aside from implementing change
management which isn't going to happen I have to do something.
.

Quantcast