Auditing Document Access
Microsoft® Internet Information Server uses Windows NT auditing capabilities so that an administrator can track exactly which users and which documents have been accessed over FTP, WWW, or Gopher. Using the Windows NT File Manager, it's possible to determine exactly who accessed any file.

Note: Audit logging is enabled only for drives and partitions with the NTFS file system. To use auditing on your server, it must first be enabled in the User Manager under the "Policies.Audit..." menu item and then configured in the File Manager for all directories on which auditing is desired. (It's recommended that only those directories for which auditing is required be enabled, because overuse of this feature will affect server performance.)

For more information on Windows NT auditing features, consult your Windows NT documentation.