There are unexpected kerberos errors returned during a password reset:
Ensure that the time is accurate on both TPAM and the managed server. If the time has drifted beyond a certain amount (typically 5 minutes), kerberos errors may be seen.
TPAM 2.5 must be configured to be in UTC, and the use of an NTP server is recommended. The TPAM Date/Time configuration can be found under the '/admin' GUI via "System Status/Settings | Date/Time Configuration".