A wrong-password lockout is almost always one of two things: mixing up the agent login password with a device's registration password, or an account still sitting on a predictable default password that was never changed. Which one applies depends on whether it's a person failing to sign into the agent screen or a phone failing to register.
Agent screen login failing
If a human is typing a password into the browser agent screen and being rejected, check whether the account was created through User Bulk Copy. With that tool, every new account is created with its password set equal to its user number, which is convenient for fast setup and a real security hole if you leave it that way. If Force PW Change wasn't turned on for that batch, the user may be typing the old default password while someone else already reset it, or vice versa. Force PW Change forces each account to set a new password the first time it signs in, so the default never survives into normal use.
It's also worth noting Force PW Change covers the agent-screen login only, which is an important limit to understand. A phone's own credentials are separate.
Phone or device failing to register
If it's a desk phone, softphone, or webphone that "won't log in," this is very often not a login password problem at all. There are two password fields, and they protect two completely separate things. The Login Password is only for logging into the web-based agent interface. It is the password the human types when they sign in to the agent screen. It has nothing to do with whether the device can connect to Asterisk. The device instead needs the Registration Password: the sip or IAX secret written into the auto-generated conf-file for this phone, the value the device itself uses to authenticate when it registers.
When a device fails to connect, the value in the registration-string it sends almost always disagrees with this field, not with the login password.
What to check
- Confirm which layer is locked out: the browser agent screen, or a phone/softphone registration.
- If it's the agent screen and the account came from a bulk copy, check whether the user is still on the default numeric password and reset it manually if Force PW Change wasn't enabled.
- If it's a device, compare the carrier or phone's registration string against the phone entry's Registration Password field, not the Login Password.
If neither of these matches what you're seeing, tell me exactly where the wrong-password message appears (agent screen, admin login, or a phone/softphone) and I can narrow it down further.
This answer has not been reviewed yet. Check anything that touches a production dialer, or ask support.