If you modify a user account and remotely shut down the system that contains the
account, you will lose the local account changes. During a remote shutdown, NT
doesn’t notify the Local Security Authority (LSA) module that a shutdown is
pending. The LSA fails to flush the database cache to disk at shutdown. Its a
timing issue. Given enough time LSA will write the modification to disk. The
immediate shutdown causes the problem. This bug in Winlogon has been fixed.
Microsoft updated the Winlogon code to inform LSA of a remote shutdown to ensure
that account changes are flushed to disk. You can obtain the bug fix from
Microsoft Support.
