Bear with me...
TIM can be fired off when someone runs CHGPWD to change their password on
Windows also. When someone changes their password in Windows it will
change it on the i.
Ok, so you want a 0$ solution.
But, keep this in mind. If TIM can do this there must be a way for others
to do so.