You need to configure Service Principal Name (SPN) records in AD DS for Password Change Notification Service (PCNS)