SafeGuard Enterprise: User is asked to provide their 'old password' during logon to Windows

If a user forgets their AD password or they change their password on a non-SafeGuard protected computer, their SafeGuard certificate password and AD password become out-of-sync. When logging into Windows, SafeGuard requests the user enters their 'old password.