I was at a client site today setting up a new laptop for them to use for client presentations.  During the course of the process they asked that I reset the password on the account they used for these demos.  Pretty straightforward request right?  Well, I went through the process from the Users screen within Server Management and through Active Computers and Users directly and regardless what I tried I could not reset the password.  After a little detective work digging through all the various options on the account I finally found the culprit.  I had forgotten (and didn't document) that when we setup this account a few years ago that we had restricted it to only being able to logon to the original demo laptop that this new one was replacing.  The client wanted a little extra insurance that someone using that account wouldn't be able to logon to another system.  So what was happening is the password reset was working correctly.  However, when I attempted to use it on the new laptop to run the Connect Computer Wizard (or via OWA when trying to test the password that way) it would return an incorrect password error.  It never gave me an error stating I wasn't allowed to access the computer I was attempting to logon to.

In summary I've learned several valuable lessons.  First, when setting something out of the ordinary don't forget to document it.  Second, don't forget to look at the big picture.  I was so focused on trying to determine why, as a domain admin, I couldn't reset a password I never considered that the password reset had actually worked and something else was amiss.