What is a good tool to monitor certain Active Directory changes? For example: We would like to see a weekly report of: newly created users, users added to groups, locked out users, domain admins.
Microsoft Active Directory Explorer allows you to take snapshots of Active Directory and compare them. I'm not sure if you can use it to automatically generate reports periodically, but it is a nice tool for monitoring changes at all levels.
I think in this case scom with ACS is a good solution.