Login Keychain issues when changing Administrator password

Totally normal behavior. The login.keychain uses the password for the account as its master password (meaning to unlock the entire login keychain), but if you use a policy to change the password for that account its doing it from the command line and there's no way for the login.keychain to get updated at the same time in this fashion. So when you later log in with password "12345" the Mac sees that the password for your login.keychain was previously "abcde" and can't unlock it, since they no longer match.

That dialog, incidentally, will go down in the annals of computing as one of the most confusingly worded dialogs Apple has ever created. You need to click the "Update keychain password" button, but on the next screen you need to enter the old password, not your current/new one. So many people get confused by this and enter their current password and it just shakes at them with no indication of what they are doing wrong.

As an aside, obligatory mention to look into tools like ADPassMon and such to help make the process of updating that password a little easier to do the next time around.

EDIT: Ok, in re-reading your post, I see you mentioned that you get this on any login after the change, not just the administrator one you changed. Are you certain about that? Because if so, something is wrong, since a policy resetting the password on one account should never affect other accounts. I would go back and take a closer look at the policy doing the resetting to make sure there isn't something set up wrong.
Also, what version of the JSS are you using for this? I'm hoping its not some unknown before defect.

OK, I can understand that for logging on to the Administrator account the first time after but why is this also happening on other domain accounts too?

Also, I did choose that option and also had to use the previous password and I agree with you that this is very confusing dialog.

Yeah, sorry I missed that you are seeing this on other account logins (updated my post above), which isn't making any sense to me. That really should not be happening. Can you elaborate on how you set up the password reset policy, and what JSS version you're using for this?

JSS 9.82

Trigger: startup, login, logout, network state change, enrollment complete, recurring check-in
Execution freq: once per computer
Target drive: /
Local Account: administrator. Action: reset password. Username: administrator

I don't have an answer for why that setup would be affecting any other accounts other than the administrator one you're targeting in the policy. You may want to open a case with JAMF to see if they have any clues.

An easy solution is to have a script remove the administrators ~/Library/Keychains folder, it will just get recreated on the first login after the change anyway.
There is also a bug in some Applications where they create a blank file in place of the Keychains folder which will generate errors on every login, the fix for this is to remove the file and replace it with an empty Keychains folder.

Both of the above will of course result in the loss of any saved passwords for the affected account.