We have only three users who are unable to log in NT domain after I
removed them off dynamic user account. I changed their passwords at
consoleone while watching the DirXML monitor on the Windows domain side.
They did sync between eDir and AD with no problem. But the users could
only log in the first login screen (which is to log in eDirectory) and
unable to log in the second login screen which is to log in the NT
domain. We are running identity manager 3.0.1 bundle at NetWare server
6.5 sp6. I did try to log in a different user to the same computer and
it went through with no problem. That gives me the idea that something
is wrong with the user account.

By the way, we only configure to sync from eDir to AD. I would
appreciate it very much if someone give me any advice to where I should
look into.