The command net user administrator, one of the output is the following:
Last logon 5/27/2017 2:31:17 PM
The system administrators have their own IDs when required to log on to this server. One suggested that it could be a scheduled task that was created and use the Administrator ID to run a task.
Could this be possible that a scheduled task reflect the last logon shown in the net user output? Thanks.