This tool is great!
http://www.scriptlogic.com/Active_Directory_Auditing.aspIf that is not an option, organize everyone who may have the right to perform such actions. Members of the Enterprise/Domain administrators group, Account Operators, etc.
List of Security Events:
http://support.microsoft.com/kb/299475/