Derik,
I'm using NCM for some compliance reports in a similar way. I'd like to setup a real-time alert of any user account activities that happen. I looked into LEM for alerts on this type of activity, but didn't see a hit when I created a new local user account on a switch. This was looking at MONITOR, Change Management, User Account Changes. It does increment when I go out of config mode, though.