Two possible fixes. Run an Emergency boot on system. If that doesn't work, then deassign user from all PCs, then synch up machine, when you see user removed, then add them back in and when successfully added back to system, on next reboot they should be able to login. If using a Password only token, they will be prompted to create and confirm a password based on your established password requirements. If using a smart card, they will be required to register (at least that is how it works for us) and then enter their pin to login.