Check Password for Windows accounts fails with error “(0X80070005) Access is denied. (0) The store password for (System Name) DOES NOT MATCH the managed system” (4323898)

This is due to a new security policy "Network access: Restrict clients allowed to make remote calls to SAM".

According to Microsoft, the "Network access: Restricted clients allowed to make remote calls to SAM" security policy setting controls which users can enumerate users and groups in the local SAM (Security Accounts Manager) database and Active Directory.

Add the managed accounts into the "Network access: Restrict clients allowed to make remote calls to SAM" policy, to do this: 

1. Open Local Security Policy, click Start, type secpol.msc
2. Navigate the console tree to Security Settings\Security Options\Network access: Restrict clients allowed to make remote calls to SAM
3. Right-Click and Select Properties
4. On the Template Security Policy Setting, Click Edit Security
5. Under Group or user names, Click Add
6. Under the Select this object type dialog box, type Users (or another local group that includes all managed accounts as its members, or name of managed accounts) in the Enter the object names to select text field, and click Check Names, then Click OK
7. Leave everything default, and Click OK

More information from Microsoft on this setting can be found here

Note: For step #6, if adding a group that contains the managed account does not resolve the issue then it may be necessary to add the functional account / managed account explicitly to the above policy. Restart is not required for this policy to take effect.

The security policy settings applies to the following operation systems: