You can also enable the usage of SYS_CHANGED for other tables. You can in fact do it for all table views. Based on your specifications, you might be interested to activate it for the following conficy tables below.
Update SYS_TABLEVIEWS set LOGCHANGES='1', ISCUSTOM='1' where NAME in ('Users','Groups','Rights','Security','Shares')
Refresh database connections and login again in the Designer. Changes a user property, or the user memberships and you will see the log lines appear in SYS_CHANGED. After that, it is just a matter of making a report on it.
Efficy is cool right?