you can monitor useradd, usermod ... commands using "ua" audit class.
Add "ua" audit class using auditconfig -setflags commands, take care this command will replace current flags so if current one is only "lo" and you want to add "ua" you must do a "auditconfig -setflags lo,ua" see auditconfig man page.
Enable audit using "audit -s" command and reboot the system
Audit event for ua class can be seen using "auditreduce -c ua | praudit"
For more detail see Managing Auditing in Oracle® Solaris 11 ( http://docs.oracle.com/cd/E53394_01/html/E54781/index.html )
You do not need to reboot, auditing is already enabled. You only need to restart the login session where the useradd/usermod/userdel will be run from so that a new audit preselection mask is applied.
Darren - Architect Oracle Solaris Security