Current Windows Event ID

https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/plan/appendix-l--events-to-monitor

~~>  User Account

4720 624 Low A user account was created.

4722 626 Low A user account was enabled.

4723 627 Low An attempt was made to change an account's password.

4725 629 Low A user account was disabled.

4726 630 Low A user account was deleted.

4738 642 Low A user account was changed.

4740 644 Low A user account was locked out.

4767 671 Low A user account was unlocked.

~~>  Audit Directory Service Changes

https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/audit-directory-service-changes

5136(S): A directory service object was modified.

5137(S): A directory service object was created.

5138(S): A directory service object was undeleted.

5139(S): A directory service object was moved.

5141(S): A directory service object was deleted.