Password reset with DNS flush

[swap007]

Hello,

I have a domain controller under which I have configured a few systems. The regular password update policy was imposed under which most of the users updated their password.

However one of them updated his password after the password expiration. Now the catch is, when he updated his password, he was able to login with his earlier password than the new one as it said 'access denied or the user is not found on the active directly' (when in-fact he was). Guess it was some cache that helped him login with his earlier password.

Subsequently. when we further diagnosed the issue we found that the DNS setting which was pointing towards to the DC got flushed and it was set to 'obtain DNS settings automatically'.

Needless to say , once that was fixed, things were back to their pristine state (just like always).

What I would like to know is why such a strange behavior occurred om the system side. 

Why did it flush the DNS settings for a password update? 

Any specific authentication process like kerberos or so might have triggered this?

Any help would be appreciated.

Regards.

[#2]

@swap007 based on how you described this, it sounds like his workstation was getting DNS info from a different system (maybe the router) instead of the Windows DC DNS server. As such everything was running with cached creds as the DNS Zone for the domain was likely not resolvable via the routers DNS. 

The fact that they could log in with old creds shows that window was attempting to use cached creds instead of validating against a DC. I'd check the event logs on the machine and see if you have errors around not finding logon servers.