[ActiveDir] Find originating DC for password change

[Kamlesh Parmar]

How do I find out, on which DC password for a particular user was changed or reset.

I know, if account management auditing is enabled, I will get a event 627 or 628.
But what if I have large number of DCs? and I don't have monitoring app like MOM ?

Last I checked, I was not able to see any metadata info for password using repadmin
Which is the first command I run for finding the originating DC for any change.

I use following command
repadmin /showobjmeta  DCNAME   UserDN

--
Kamlesh
~~~~~~~~~~~~~~~~~~~~~~~~~~~
"Be the change you want to see in the World"
~~~~~~~~~~~~~~~~~~~~~~~~~~~