Your mention of password changing across a plethora of devices reminds me of the "Password history check (N-2)" feature of 2003 Server ( hxxp://technet.microsoft.com/en-us/library/cc780271%28v=ws.10%29 ). badPwdCount doesn't get incremented if the invalid password is one of the last two entries in the password history. I don't know if any other authentication services implement this functionality.