What information may an attacker obtain with WMI access to the Windows domain controller security events?

What information may an attacker obtain with WMI access to the Windows domain controller security events?
A. user password
B. user login and logoff events
C. file share names
D. active directory configurations