Monitor Pack (MS6) - Windows - Monitor Use of User Rights
Monitor pack for monitor Solution 6 (conversion to monitor Solution 7 in progress)
Windows NT and Windows 2000 include the ability to audit the use of user rights (also known as privileges).
Enabling success and failure auditing for the "Use of User Rights" category will enable the following events:
576 Special privileges assigned to new logon
577 Privileged Service Called
578 Privileged object operation