i just spoke with an organization the other day that had an active directory security breach at the domain admin level.
With native tools, there was no audit trail, so they couldn't perform forensics to determine how and when the breach occurred.