@MastaMia - In general, your question has a greater chance of being answered by experts in the Answers community when when you provide as much information and context as possible.
for windows look for events 4720 account was created and 4732 (or related) account was added to a global security group
read here and then move to related events (from the link)
linux has less verbose logging than windows but i can think of some ways to monitor that.
most of the time each user will have its own home directory and therefore if you see a new source it means a new user.
also there are ways to monitor the suduers list on linux
hope it helps a little