AD authentication using DIGEST-MD5: users have to reset password?

Question

We are using DIGEST-MD5 to authenticate users against Active Directory. Our application ask users for user name and password and pass them to the attached java code. The strange thing is that it works for about 98% of users and it won't work for 2% of users. For those 2% of users, they can login into our domain but the same password won't work for our application.
We have found the workaround will be to ask those users to change their Windows password and after that they will be able to login.
My question is why= changing a user's password will make a difference for those 2% users? I am really puzzled.
Thanks!
try {
Hashtable authEnv = new Hashtable();
//set security credentials, note using DIGEST-MD5
//Requires user account to be stored with reversible encryption
authEnv.put(Context.INITIAL_CONTEXT_FACTORY, "com.sun.jndi.ldap.LdapCtxFactory");
authEnv.put(Context.PROVIDER_URL, ldapURL);
authEnv.put(Context.REFERRAL,"follow"); // required
authEnv.put(Context.SECURITY_AUTHENTICATION, "DIGEST-MD5");
authEnv.put(Context.SECURITY_PRINCIPAL, creds.getUsername());
authEnv.put(Context.SECURITY_CREDENTIALS, creds.getPassword());
DirContext ctx1 = new InitialLdapContext(authEnv,null);
} catch (Exception ex) {
logger.info("Error authenticating user " + creds.getUsername(), ex);
throw new AuthenticationException("Authentication Failed for user " + creds.getUsername());
}

Answer 1

Make sure which version of AD you are using: AD 2000 or AD 2003. For AD 2000, reversible encryption is required and it's not secure. That's why lots administrators do not like it. But for AD 2003, there is no need for password to be stored in reversible way. But there is limitation as to the client application. What works for AD 2000 may not work for AD 2003. For details, you can check the link below:
http://www.forumeasy.com/forums/thread.jsp?tid=115170863235&fid=ldapprof5&highlight=Why+DIGEST-MD5+Authentication+Does+Work
which summarized all working and not-working cases of Digest-Md5 authentication for SunOne, AD 2000 and AD 2003. It's quite informative.