Finding ARD access info in logs...

Hello,

Our old network consultant accessed our network and changed all of the passwords causing a great disruption to business. There is criminal legal action under way and we need to gather some evidence of his activities. Is there a particular log in the console that would show ARD access? If not in the console, how do I find it?

Thank you 🙂