vastool password command error: "KPASSWD_HARDERROR: Hard error" (4295936)

$ vastool passwd
Changing password for biguser@idmdomain.com...
Password for biguser@idmdomain.com:
New password for biguser@idmdomain.com:
Verify password - New password for biguser@idmdomain.com:
ERROR: VAS_ERR_FAILURE: Unable to modify password for biguser@idmdomain.com.
Caused by:
KPASSWD_HARDERROR: Hard error
ERROR: Could not modify password

Microsoft group limitation when an account belongs to more than 1015 groups.

E.g.:

bash-3.00# vastool -u biguser auth dumppac | grep Group | wc -l
Password for biguser@idmdomain.com:
1020

WORKAROUND:

Change the registry key as shown in article http://support.microsoft.com/kb/263693.

RESOLUTION:

Reduce the number of groups that user is a member of. 

Here are a few Microsoft KB articles for your reference:

Users who are members of more than 1,015 groups may fail logon authentication
http://support.microsoft.com/kb/328889

Error message: During a logon attempt, the user's security context accumulated too many security IDs
http://support.microsoft.com/kb/275266

New resolution for problems with Kerberos authentication when users belong to many groups:
http://support.microsoft.com/kb/327825