http://blogs.msdn.com/dsadsi/ is our team blog, and I have a post on it today, http://blogs.msdn.com/dsadsi/archive/2009/10/02/can-we-know-who-has-changed-an-attribute-in-active-directory.aspx.  I'd like to thank Max Vaughn, Glenn Zuckermann, Bill Wesse, Domenic Salermo, and David DeGroot for the discussions that lead to that blog.  It seems much harder to talk about how it is impossible to do something, rather than to just go ahead and do it -- but of course, it isn't.