I have my eDir user synced to AD

Users passwords in Edir do NOT get changed, yet from time to time (every few
days?, a couple of weeks?) users passwords in AD are random (not the same as
in eDir)

Users can not login to AD controlled resources

I can not read AD stored password, so do NOT know what it is

I can read eDir stored UP & reset Ad to match it (manually) and then all
works fine again

Complet madness...

Anybody has any hints?