Sorry to hear that sir. With NPM 10.7, you can set baseline thresholds for interface traffic that could detect anomalous traffic. SAM also has templates for most of what you are looking for:
*When a user logs on to a server - Windows event log monitor for login events
* When DNS has been changed e.g. a record added or removed? DNS User Experience Template would alert on this
* When a users password has been changed / expired / account disabled in AD? Windows Event Log monitor would enable this. May be worthwhile to check out SolarWinds Log and Event Manager: SIEM | Log Analysis | Log & Event Management for IT Security & Compliance | SolarWinds