My question is how ADSI performs SetPassword operation. According to what I have read ADSI is a COM interface and it has more capabilities than AD provides through LDAP. While you are suppose to update unicodePwd attribute of a personaccount entity through LDAP, ADSI provides you SetPassword call. I know that ADSI & AD provides Kerberos during authentication. So how the password is transmitted to server when SetPassword is called? Is it raw binary unencrypted data? Or does Kerberos comes into play at this call?
The netlogon service changes the password over RPC, usually contacting the PDC emulator directly.
Check this to see how the session is established: http://msdn.microsoft.com/en-us/library/cc208245%28v=prot.10%29.aspx
So no, the password is not sent in clear text over the wire. It could be sniffed locally on the DC that is on the receiving end however. Some password sync tools work like that, actually.