OK here goes I have a client that caught an administrator(there is more than one) making changes to files and directories and user accounts but said he had done nothing. We had logs of him making the changes and put him on probation. The admin then changed something in auditing or events so that when you add or delete a user you only get that the user was modified or deleted and it says system did it instead of the person actually doing the modifications.
I know it is not much to go on. The domain is 2008 r2 and in 2008 mode. Any ideas would be greatly appreciated.