CA is reporting the authentication type of the AD password change events as "Simple bind" which happens on port 464 with Kerberos protocol or in environments that use other LDAP ports with LDAP signing and channel binding token enabled (to prevent simple bind on port 389):
Port 464 is reserved for the Kerberos change‐and‐set password protocols, not for general LDAP operations. LDAP simple binds (using a DN and password) are processed on port 389 (or 636 for LDAPS). Port 464 is dedicated to handling password changes via the Kerberos protocol (as defined in RFC 3244 and related drafts), and it should not support LDAP bind requests.
The product teams acknowledged this behavior in this event type and logged an enhancement request with ID 544421 to evaluate and implement a correction or fix in a future release. Currently, there is no ETA.
