After installing DSFW in my edir 8.8.5 tree, and re-samifying users,
I'm running into a weird issue.

Some of my users cannot login to the AD domain, they get this error:

The system could not log you on. Make sure your User name and domain
are correct, then type your password again. Letters in passwords must
be typed using the correct case. I know the password I'm using is
correct, as they can login to edirectory w/ the same password.

If I go into iManager and change said user's password, they can login
to the domain just fine.

Weird thing is, *some* users in my tree are able to login to the AD
domain without a problem the first time they try.