log files

I run a W2K server that is used as an FTP site for our
company's customers. This system is also accessed by an
internal department via the MS network and Appletalk
though a separate network card.
The W3C logs that are generated by the FTP side are just
great, but what I'd like to do is to monitor activity
(read, write and etc) on the internal side and be able to
have a log file for this also that is similar to the FTP
side.
True is, that I think I have an internal malicious user
that is removing customer files (cut and paste as no trash
exists)and I like to be able monitor activity.
Any suggestions? Thanks