Check Point Identity Awareness (had to supply all PDC in order to capture all IA.)
AD Query reads these events from the Security Event log:
On Windows Server 2003 domain controllers - 672, 673, 674
On Windows Server 2008 domain controllers - 4624, 4769, 4768, 4770
If the domain controller does not generate these events (by default they are generated), refer to Microsoft Active Directory documentation for instructions on how to configure these events.