There are security events in Windows logs showing Altiris jobs are looking for Admin credentials.
ITMS 8.x
"Collect Delta Hardware Inventory" or "Collect Full Inventory" jobs are running
By default the job or policy of 'Collect Delta Hardware Inventory' is set to gather 'Admin Group Members' which cause the Windows Security Events capture and log them.