The following steps will create a search that alerts on password changes:
1. Click the 'New' or 'Plus' icon (+) in the button bar menu of the Change Auditor Client search tab to create a new search.
2. Enter the desired name in the 'Search Name' field of the 'Info' tab in the search properties.
3. Select the “What” tab and click the 'Add' or 'Plus' (+) button in the button bar of the search properties.
4. Search for or enter a keyword in the Event Class filter to find 'User password changed' and 'User password changed by non-owner' Event Classes..
5. Select each and click the 'Add' button to move the Event Classes to the lower section. Click 'Ok' when all event classes are added.
6. Click 'Select' when the Event Classes are added.
7. Still under the 'What' tab, click the down arrow to the immediate right of the 'Add' or 'Plus' (+) button in the button bar of the search properties.
8. Select Subsystem and then Active Directory
9. Select for the 'Scope' the 'This Object' Radio button in the top section of the 'Object Picker' form. .
10. Search for using the search button on the right edge of the 'Object Picker' window or browse to and select the target user account(s) in the AD object selector in the mid-section.
11. Click the 'Add' button at the bottom of the window to move the selected object into the lower section.
12. Click 'OK' when the user accounts are added.
13. Select the Alert tab
14. Check SMTP
15. Enter the email address(s) (or click the ellipsis to find them) for the people who should get the alert
16. Make any additional changes for the Custom Email alert and then click OK
17. Check Alert Enabled
18. Click Save