I really like the new APM template for Windows Server 2008 Domain Controller Security for the graphing and historical data.
The problem with them is that there needs to be a way to alert on values you create rather than if the query returns a record set or not.
For example, we have over 50,000 users. I would like to see how many users are currently locked out, and alert if that value is more than say 500. As "User Account: Account was locked out" is currently written, you get a down if there are any users locked out, and an up if the query returns records. With that many users, we are always going to have someone locked out.
