If your firewall, web server, or router writes logs to a different location than the compromised system, remember to check these logs as well. Check for odd user accounts and groups. Check all groups for invalid user membership. Some of the default NT groups give special privileges to the members of those groups. Members of the Administrators group can do anything to the local system.
Backup operators can read any file on the system.
PowerUsers can create shares. Look for invalid user rights. To examine user rights use the User Manager tool under Policies, User Rights. There are 27 different rights that can be assigned to users or groups. Generally the default configuration for these rights is secure.