It would be nice to have additional AD events logged.

Events such as:

Account Lockout

Account Unlock

Account Creation

Account Delete

Account Disable

Account Enable

GPO Changes

GPO Deletes

GPO Additions