How to trace an admin login to active directory server (2008 R2) from which host or which ip (In the situation where multiple admin are working) ?
It is checkpoint's feature to do what you want.
The basic idea is simple. Monitor DC's windows event log for user's logon message. There are specifc event types for user logon event. There is IP and user binding info you need in the log message.
For multiple domains, you need monitor all DCs of the domains.