Auditing who changed the local administrator password of the Member server "POSSIBLE"?

It is pretty hard to obtain that information after the event has occurred but for future detection you can enable detailed auditing and within the configuration, you can configure the systems and successful and/or failed events you wish to audit. Following articles outline how to enable and analyze the results:
http://support.microsoft.com/kb/814595/
http://www.windowsecurity.com/articles/Understanding_Windows_Logging.html
http://207.46.19.60/technet/prodtechnol/windows2000serv/maintain/monitor/logevnts.mspx

Thanks Rob ,

 The links which you have provided are AD Specific ( I know the Auditing in AD ). Now my question is , Can I audit the local administrator member password reset events?

 SInce this is being a local administrator account , Can we configure who has reset the local administrator password of a member server?

If this is possible , then How to carry out this task?

Thanks,

_Prashant_

Rob,

 I understand that it wont show the past events. I have configuerd it on my test machine and changed the local administrator password of it....

Guess what it worked ,  the Event Which got generated was 642 under security event logs....

so,
 Computer Configuration\Windows Settings\Security Settings\Local
Policies\Audit Policy\Audit account management is the auditing setting which needs to be enabled for this.

I have not tested this with 2008 server ( AS I dont have the test machine).

It worked for me......

Thanks for your help Rob

Cheers,

_Prashant_

I've requested that this question be closed as follows:

Accepted answer: 0 points for PrashantGirennavar's comment #a38394999
Assisted answer: 200 points for RobWill's comment #a38394658

for the following reason:

Tested by myself

For windows server 2008 - Event ID is  - 4738.

Thanks PrashantGirennavar.
Glad to hear it worked for you.
Cheers!
--Rob