JSI Tip 4259. How do I monitor a system for unauthorized user access?

Microsoft Knowledge Base Article 300958 contains the following summary:

This article describes how to monitor your system for unauthorized user access. There are two main steps: Enabling security auditing and viewing the security logs. Note that different systems have different security needs, and the security topic is complex. Any user who sets up security audits on your system must be assigned to administrative groups or be given security rights and privileges.