@Boris Yakimov, On windows you could monitor for Windows Security Events using windows_events table that must be auditing password change related operations