If a hotfix has been installed, you would see
Event Type: Information
Event Source: NtServicePack
Event Category: None
Event ID: 4377
Date: 1/19/2005
Time: 4:28:32 PM
User: S-1-5-21-1957994488-2139871995-839522115-500
Computer: TEMPLATE
Description:
Windows 2000 Hotfix KB823182 was installed.
You can audit logon to see who was on during that time. In addition, you can audit file changes on Winnt folder for service packs and hotfix installs.