If you modify a user account and remotely shut down the system that contains the account, you will lose the local account changes. During a remote shutdown, NT doesn't notify the Local Security Authority (LSA) module that a shutdown is pending. The LSA fails to flush the database cache to disk at shutdown. Its a timing issue. Given enough time LSA will write the modification to disk. The immediate shutdown causes the problem. This bug in Winlogon has been fixed. Microsoft updated the Winlogon code to inform LSA of a remote shutdown to ensure that account changes are flushed to disk. You can obtain the bug fix from Microsoft Support.