Our Built in Machine Administrator accounts keep getting disabled, even after we re-enable it on our Computers (win 10).

Question

Our Built in Machine Administrator accounts keep getting disabled, even after we re-enable it on our Computer's (win 10). The Passwords are not Blank. This has only been happening for the last month or so as far as we can tell.

There are no GPO's in place for this, so it is happening on its own.

Answer 1

You may want to consider auditing local user account management.

https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/audit-user-account-management

Event viewer will provide you this information as well.