Domain admins group were removed in very strange way

Hiya’ll
I stand with Windows Server 2003 Native AD mode.
In This days our members of the Domain admins group were removed in very strange way and leaving the group empty.
When i checked the event log :
A member was removed from a security-enabled global group
Subject:

Security ID: SYSTEM
Account Name: WIN81-WS$
Account Domain: GovSecLAB
Logon ID: 0x4d2dce56
Member:
Security ID: GovSecLAB\sample
Group:
Security ID: GovSecLAB\Domain Admins
Group Name: Domain Admins
Group Domain: GovSecLAB
Additional Information:
Privileges: -

This is very important
Help please!!

thanks Thomas

Hey Thomas
Thanks for posting,


According to event log
4729 A member was removed from a security-enabled global group.

From the event log it’s user WIN81-WS who initiated the action to remove members from Domain Admins group.
You must check if WIN81-WS did this by a mistake.