I've recently come across a situation where somebody couldn't log in with their AD credentials, turned out the account had been renamed... and nobody knew who (or what) did and why.

I don't know if AD comes without audit logging, or it was just disabled in that installation, but that seems to be a pretty big no-no for a central part of your authentication infrastructure.

(Granted, it's an anecdote, but too many WTF anecdotes make me not like a thing as well).