logs of hackers?

I’ve noticed that on my win2000 machine I see the guest account enabled and a part of the administrator group. I know i disabled it a while ago, is there any way I can find out ‘when’ it was altered and by whom-computer? do/can any windows updatingmodify that?

thanks