The exact problem is pretty straight forward. A week ago, I could right click on a users name in EEM, click reset local recovery, get reset successful, force Sync machine and the next time the user logged in they got asked their three question. This week it isn't working. My point is that it is never consistant. One morning it might work and by the afternoon it won't.
Even the local recovery itself is pretty flaky. After the three questions are answered, sometimes you have to click Password Only Token to login with default password and other times it goes straight to changing password.