Universal Password migration will fail if the "Allow user to initiate password change" is disabled in a Universal Password Policy

After the NDS password has been validated for a user during the users first login after Universal Password has been enabled for a user, the NDS password will be "migrate" or set the Universal Password to the validated password. This is called a "Password Migration".

However if the Universal Password policy has been changed to disable the option of "Allow user to initiate password change", this password migration, or initial password set will fail.

Current work around is to enable the "Allow user to initiate password change" in the Universal Password Policy.