An account tied to a directory asset fails password check tasks but password changes are successful and the password works to authenticate if checked out and used manually.
The following error is presented in the Operation log of the check password task:
Debug Access Denied Hercules.Modules.Exceptions.AccessDeniedException: Access to the resource was denied at Hercules.Modules.Windows.Ad.WindowsAdModule.
The account is a member of the Protected Users security group in Active Directory.
Members of the Protected Users security group are unable to authenticate with NTLM authentication which prevents Safeguard for Privileged Passwords from successfully impersonating the account to check the password.