Keychain doesn't update stored domain password

I work in the IT Department. I have about 3,000 Windows XP machines and just 10 Mac. The graphic designers have to be special. The macs have been bound to Active Directory. The issue that is causing me such headaches and sleepless nights is that when the Mac users change their domain password every 30 days, they get locked out of the printer server, intranet and entourage email (Exchange 2003).

How do I get the keychain to update the stored domain resource passwords (exchange, intranet, print server) with the new domain password? I really need these people to stop calling the helpdesk every 30 days.

The Macs run DAVE and do connect to Windows Shares. They are all brand new Macs running the latest OS Snow Leopard with all the updates.

Sorry if this is a double post. I don’t really know what to ask the Almighty Google.

What Version of Windows Server are you using? Im on 08 and my Mac seems to play nicely with it. How have you got the Macs set up through the Server? Probably not the best if theres a lot of Macs on the Server but I've had to set up Reverse DNS just to get the NET BIOS names right in the DHCP in the Server