That's more of a snapshot question than an event question.
Logparser could give you the 636 events when users are put into the Administrator groups and Power Users local groups (following the advice that "Power Users are just Administrators who haven't made themselves into Administrators yet." The query to do that is something like this (%Name% is the name of the system you are looking at, and we're looking for SIDs instead of "Administrators" because you'll want to be language independent):
select TimeGenerated,ComputerName,Strings
from \\%Name%\Security
where
((EventID=636) or (EventID=637))
and
((Strings like '%{S-1-5-32-544}%') or (Strings like '%{S-1-5-32-547}%'))
But that only tells you what happened, and it won't even tell you that if the log is erased by an unwanted admin (and it only gives you the SIDs of the accounts added -- use psgetsid to look them up). So you need a different -- snapshot -- approach. I wrote a perl script to do that -- basically using the network remote management API in Windows -- but I'm not posting it here because I'll get heckled, and it depends on a lot of monitoring infrastructure.
To be honest, I think the best approach now would be VB and WMI and I think the Scripting Guys published something similar on Technet recently.