Can solarwinds alert on change in ad group membership, either adds or deletion of members?
Yes. You need to enable the relevant policy for your "default domain controller security policy"
Group membership change events are logged with either ID 630 on a Server 2003 network. 2008+ logs events 4728 (add member) and 4729 (delete member).
You can then configure your domain controllers with their built-in evntwin.exe tool to forward the required events to Orion as SNMP traps and then alert on them. You can pick out the required variables ("varbinds") from the trap, to include in the email alert or run a program to do "stuff" with the information, or you can query the Orion trap database yourself - it's quite easy with Powershell but does require some development time to code it properly.
Orion's SNMP trap alert config GUI is often annoying and sometimes limiting, but it does the job for basic tasks.
