How to audit password changes in active directory

[SWarrior]

We have a situation that we need to audit password changes. In the event that someone with domain admin access changes someone's password without the users permission.

I would greatly appreciate it if someone can point me in the right direction or even a kb article would be nice.

But most importantly, to see WHO made the change. And then when the change is made, to possibly send an email, but the sending of the email could be scripted.

Thanks in advance,
-SWarrior