Active Directory Built-in Administrator account

HI,

What is the event you are seeing ? Can you please provide Event ID / description ?

Regards,
Ram

Hello .. these are the events .. I also attached them .

EventID      Event Name
528      Successful Logon
538      User Logoff
576      Special privileges assigned to new logon successfully
552      Logon attempt using explicit credentials
537      Logon failure - The logon attempt failed for other reasons

Have you got any services or scheduled jobs set-up that use it ?

Hi KCTS .. no to the question below .

" Have you got any services or scheduled jobs set-up that use it ?  "

Which user has this logs ? is it from SYSTEM user ?
DCs will not have local user account

This is for the built-in MyDomain\Administrator

Did you perform runas option ?or any application was started with admin privilege?

no action has been taken with that account ..

Is there any map drives created using this user. Also, you can clear the cached password from the  code mentioned in below link

https://www.experts-exchange.com/OS/Microsoft_Operating_Systems/A_448-How-to-DELETE-Windows-Local-Domain-Cached-Credentials.html

No mapped drives , no services , nothing .. No one knows the password so why its so strange that we would see those events coming from that account on some of the DCs.

Thank you all for the great info .. I will work with these ideas and post back .