RM Unify User Audit log contains the following error event: 

Update AD User
ERROR.  User <username>.  Failed to decrypt password 

For the same user, you may also see a successful password change event: 

Update AD User
SUCCESS.  User: <username>. [AD]: New Password Set.  [AD]: User Updated.

The RM Unify Network Agent should only be running on one domain controller (DC) on the network, so this issue can occur when you have two DCs running the RM Unify Network Agent service, most likely as a result of installing the RM Unify Network Agent to a new DC but failing to stop and uninstall the Agent from the original DC.

Both the running Agents will receive the same user message from RM Unify and try to process it. As passwords are encrypted with a DC-specific key, only one DC will be able to decrypt the received password change and apply it to the user's AD account. The other DC will fail to decrypt the password change and report an error to the RM Unify User Audit log. This explains why you see both a successful password change event and a failed attempt.

1. Stop and disable the RM Unify Network Agent service on the old DC.
2. Using the RM Unify User Audit log, confirm if the new changes to RM Unify users continue to be successfully processed on your AD by the remaining RM Unify Network Agent service.
3. Confirm if a user can:
1. Change their password in RM Unify and successfully sign into RM Unify and the school network using the new password.
2. Change their AD password and successfully sign into RM Unify with the new password.
4. Check if no new errors are being logged to the RM Unify User Audit log.
5. On the old DC, uninstall the RM Unify Network Agent application from Programs and Features.