date stamp when accounts disabled?

On NT4.0, if the event log does not go back far enough, is there a way to tell the date and time when an NT account was disabled? (maybe somewhere in the registry?)