2008 Clusters can't change password

Last week MS's PFE Moti Bani and me solved a problem that bugged me for ~ a year - since the day we've started deploying 2008 clusters in our production environment:
2008+ Clusters can't update their CNO and VCO accounts' passwords.
The error, as shown in the cluster administrator ...

more ...