You would need a SEIM tool or look at WEFFLES by Jessica Payne. Running ADUC from a workstation won't be captured on a DC but the actions (edit, disable, create) should be if your auditing is done right. Don't forget as well as setting the audit policy GPO, you have to configure the auditing in the SACL

www.000webhost.com