Forensic tracking of your salesforce.com users

Ever had an employee go bad? Ever learned that an employee got fired on Friday, but no one told you to remove their salesforce access until Monday? I am always surprised when this happens, but, it does happen. Recently this scenario happened to me. Some genius decided to fire a senior executive, but not tell me about it for 2 days. That left me wondering if he had done anything in salesforce that he wasn't supposed to.



Unfortunately, salesforce doesn't have the type of forensic tracking built-in to the system for you to access the way Netsuite does. But here's a few things available to you if you find yourself in this situation.
1- Check the login history of that employee. Setup>Manage Users>Users then click on that users' name. Scroll to the bottom and click the link "Download Full Login History (csv) »". That will tell you when they logged in. It won't tell you when they logged out, however. It also won't tell you what they did when they were logged in.
2- On Leads and Opportunities, there is some history information available (if you've enabled it).
3- But the real information comes from salesforce professional services. For $500/user/day you can get them to send you the logs of everything that user did. Everything. What they downloaded, what they viewed, what they changed etc. The logs are very cryptic looking but it doesn't take long to be able to decipher them. Contact your account rep to find out more.