I am trying to understand a control our clients have in regards to user creation monitoring in AD. They want to implement a control that will notify a specific team with the complete list of new accounts created during the last month. My question is the following: Can I consider this report complete if I get it from AD, or is there any risk that Domain admins can alter this information in the AD data set? I am not concerning about the report being changed during transmission, only at the source. Please let me know if any further details are required. Thanks in advance!