Thanks Tim for the quick reply.
I have checked Audit Viewer and found entry for the guest account but i don't know how to read it. Can you please help me with that, i have attached a screenshot. How do i find out when was it changed (expiry) and by whom ?
Secondly, do i have to check for logs in configured external Syslog server or i can see logs within CPPM somewhere ?