AD password not changed from Sys Prefs > Users & Groups

When I've seen this in my AD environment, it usually means their connection to AD has become out of sync. Most of the time, un-binding and then re-binding through directory utility fixes the issue with no problem.

This definitely means the unit is no longer talking to Active Directory. We have systems on our Domain experience this on a somewhat regular basis. So much, that I've written an Extension Script to find these systems when they are in this state:

#!/bin/bash

domain="LOGIN-DOMAIN"
user="saMAccountName"

# Can we query a UPN?
domainAns=`dscl /Active Directory/${domain}/All Domains -read /Users/${user} dsAttrTypeNative:userPrincipalName`
if [[ $domainAns =~ "is not valid" ]]; then
    result="Invalid"
else
        result="Valid"
fi

echo "<result>$result</result>"

saMAccountName is just any valid AD user. You're just making a query to your AD.

Same as @perrycj][/url. We see a Mac get put into an archive OU or are in disabled status in AD.
rebinding (we usually delete the object first) seems to help.

@pickerin: thanks for that!