還是不知所雲

>>>but if the administrator wants to manipulate your ...

what is the administrator here? a job title? or the user name?
the user administrator has rights to do whatever. the person who holds administrator job may not be the administrator user of your computer.

TO ENABLE AUDITING AND CHECK SECURITY LOG:

start > run > gpedit.msc > OK

navigate to
computer config > windows settings > security settings > local policy > audit policy
enable all but object access.