How to audit changes to your active directory on Windows Server 2008
> How to audit account access on Windows Server 2008
In server 2008, you can track attribute changes that let you track old attributes and new attributes.
You can configure active directory auditing by editing the default domain controller policy. On Group Policy Management Editor, expend Computer Configuration > Windows Settings > Security settings > Local Policies > Audit Policy
You can view all the audit events from Windows Security Event Log. The cool thing is attribute changes—both the old value and new value is written to the event log.
