One of the most recommended security modifications to do is to rename the Administrator account to something else (call it ZEBRA). You then make a brand NEW account, and call that one ADMINISTRATOR.
You then assign this new account virtually no rights. It is NOT a member of the Administrators group; it can't install anything; it has no rights to the Registry. It is there just to lure attackers into trying to hack it (call it a "honeypot" ).
Meanwhile, the real admin account (ZEBRA in this example) is there to be used for any admin type thing.
So, your Admin account might actually be there and have all of the power it needs. YOu just have to find it.
Now, one way I can think of is if you check the SID information for all the accounts on these machines. There are a couple of tools floating around the Internet that could be useful. One is called USER2SID.EXE. This tool will take a user name on a machine (and this can be launched against a remote machine) and give you the SID for it.
Now, the Administrator account, even when it is renamed, keeps its same SID. And the SID for the Administrator account always falls into the same parameters:
S-1-5-21----500
It will ALWAYS start with S-1-5-21 and the last 3 numbers are always 500. So, get a copy of USER2SID, and run it against every account on the machine. When you find a match, log in as that account, and that will be your Admin account.
You can get the tools here:
http://www.packetstormsecurity.org/NT/docs/sid.htm
