Great Links from Microsoft on AD Auditing
Audit Policy
http://technet.microsoft.com/en-us/library/dd941595(v=ws.10).aspx
Building a Case
http://blogs.msdn.com/b/ericfitz/archive/2008/08/20/tracking-user-logon-activity-using-logon-events.aspx
Security Events
http://support.microsoft.com/kb/947226
AD Diagnostic Logging
http://technet.microsoft.com/en-us/library/cc961809.aspx
Audit AD User Creation/Deletion
http://social.technet.microsoft.com/wiki/contents/articles/17055.event-ids-when-a-new-user-account-is-created-on-active-directory.aspx
http://social.technet.microsoft.com/wiki/contents/articles/17056.event-ids-when-a-user-account-is-deleted-from-active-directory.aspx
