We seem to be having a recurring issue with our current WSS2 install.

It seems that whenever a person's AD account is modified, they get
locked out of WSS2 for at least a day. It's as if the WSS2 server is
caching AD info or something like that.

Not being an AD/networking person, I'm not sure where to begin looking
at the source of the problem.

Some specific examples:

A person returns from vacation, is greeted with the AD "your password
has expired, please create a new one", they do, they log into their
computer, and then log into WSS2, but are denied access to WSS2. A day
or two later, things are back to normal.

A person gets their AD account locked trying to incorrectly log into any
number of network systems. Network folks unlock their account, they can
get back into their computer, but are denied access to WSS2.

Any ideas what might be causing this issue?