This can be accomplished by auditing changes on the registry key corresponding to the Administrator account. See Q173939
Lost the administrator password? See Recover Lost NT Administrator Password for do-it-yourself, freeware, and commercial solutions.
