Security check and documentation

Hi,

We have WS2003 and 2008 DC's in our environment. I'd like to create some security healthcheck about password policy, audit policy, access to events, compare our GPO security settings with best practices and as final create document with our revision. I'll also include powershell scripts to count number of "password never expires" settings, how many users have expired password (ex colleagues), etc. Questions:
- can I found somewhere useful template for that, I mean what should I include in this kind of revision?
- what should be official baseline from Microsoft (Security Compliance Manager or?) regarding suggested values of seetings?
- which AD atributes should I include in powershell scripts?
- please advice whatelse is useful, ideas, documents, templates, ...

Thnx!