You may require additional audit logging to see all events in your environment

Retrieve user creation/deletion and password reset events from the sophos_windows_events table

This query retrieves account creation, deletion and password reset events under Windows. 

You can specify the number of days you want to go back, which is specified in the variable Days (string).

   datetime(swe.time,'unixepoch') Date_Time,
   json_extract(, '$.EventData.TargetUserName') AS User_Name,
   CASE swe.eventid
      WHEN '4720' THEN 'Created'
      WHEN '4724' THEN 'Passwort Reset'
      WHEN '4726' THEN 'Deleted'
   END 'Action',
   json_extract(, '$.EventData.SubjectUserName') AS By, AS Details
FROM sophos_windows_events swe
WHERE eventid IN ('4720','4724','4726') AND time >= strftime('%s','now','-$$Days$$ days')