Hi @Davejosh21,
this line should work:
GetEvents -logname "Security" -eventid 4720 -lookuphours 24 -servicename "Windows-user-created" -threshold_warning 1 -threshold_critical 2 -description "A user account was created."
There is a wiki article from micosoft on how to configure the right policies on your active directory. Take a look here: