I believe event ID 645 is the creation of a user account in the domain.
I use the GFI event log watcher and track that event on the network.
-----Original Message-----
From: Lee Clemens [mailto:lee (at) leeclemens (dot) net [email concealed]]
Sent: Tuesday, August 22, 2006 9:26 PM
To: focus-ms (at) securityfocus (dot) com [email concealed]
Subject: User...
I use the GFI event log watcher and track that event on the network.
-----Original Message-----
From: Lee Clemens [mailto:lee (at) leeclemens (dot) net [email concealed]]
Sent: Tuesday, August 22, 2006 9:26 PM
To: focus-ms (at) securityfocus (dot) com [email concealed]
Subject: User...
[ more ]