Steps to enable auditing using the Group Policy Management Console (GPMC):

Perform the following actions on the domain controller (DC):

1. Press Start, then search for and open the Group Policy Management Console, or run the command gpmc.msc.

2. Right-click the domain or organizational unit (OU) that you want to audit, and click Create a GPO in this domain, and Link it here. If you have already created a Group Policy Object (GPO), go to step 4.

3. Name the GPO.
4. Right-click the GPO and choose Edit.

5. In the Group Policy Management Editor, in the left pane, navigate to Computer Configuration → Policies → Windows Settings → Security Settings → Advanced Audit Policy Configuration → Account Management.

6. In the right pane, double-click Audit User Account Management and check the boxes next to Configure the following audit events:, Success, and Failure.

7. Click Apply, then OK.
8. Go back to the Group Policy Management Console, and in the left pane, right-click the desired OU in which the GPO was linked, and click Group Policy Update. This step makes sure the new Group Policy settings are applied instantly instead of waiting for the next scheduled refresh.

Steps to view these events using the Event Viewer:

Once the above steps are complete, events will be stored in the event log. This can be viewed in the Event Viewer by following the steps below:

1. Press Start, search for Event Viewer, and click it to open it.
2. In the left pane of the Event Viewer window, navigate to Windows Logs → Security.
3. Here, you will find a list of all the security events that are logged into the system.

4. Under Security in the right pane, click Filter Current Log.

5. In the pop-up window, enter the desired Event ID* in the field labeled <All Event IDs>.

6. Click OK. This will provide a list of occurrences of the entered Event ID.
7. Double-click the Event ID to view its properties (description).

Auditing the password changes through the above manual method becomes tedious, as every organization deals with hundreds to thousands of user accounts.

ADAudit Plus, a comprehensive AD auditing tool, enables admins to effortlessly audit password changes and other Active Directory changes.