What might cause users to NOT be able to change their passwords either by (1) logging into Windows 7 and using the ctrl-alt-delete "Change a password..." option OR (2) by using the client's "User Password Administration" dialogue? Both routes give errors about the "Old Password" not being correct, or not being able to be used. Option two actually tells me that the old password is wrong:

"Incorrect Old Password given on OUR_TREE_NAME_HERE.
No passwords have been changed.
Please re-enter Old Password again."

I can verify, though, that my old password is being typed correctly since I just logged in with it. The auth / password process is a bit opaque to me, so if anyone could maybe give me a hint about how the plumbing on this stuff works so that I can figure out why it's failing, I'd be very appreciative.

Client version IR10b
Windows 7
server = OES 11.2, patchlevel 2