Evaluate Employee Activity Patterns

Resources for Admins when researching users activity:

Monitor Login History

Admins can monitor all login attempts for their org and enabled portals or communities.

Monitor Identity Verification History

When the user successfully provides a time-based, one-time password as proof of identity, that information is recorded in the Identity Verification History.

Setup Audit trail 

Tracks some admin level changes but will also show maintenance updates from our backend engineering teams. Audit history is especially useful in orgs with multiple admins.

Note: Setup Audit trail is not to be used for standard user forensics.

Paid Add On Services - Historical Event Logs

Available with service fees. The Historical Event Logs process is a paid add-on service process offered by Salesforce to investigate record, org and or user activity including logout. As part of the Historical Event Logs service we will provide logs for either a specific User, Record or Organization within 30 days or less.  Support does not have access to logs beyond 30 days.

Pulling out a History Report

Admins can pull out a history report for any object including custom object. Go to New Report. In the Quick Find Box type "History". Then select the object you would like to report on. For example, if you ant to track a lead status change for your org then set filter Field/Event contain Status. This will show you status change values for the lead. (old value to new value). You can summarize this report by user or status. Unfortunately you will have to do this for each object.