Secure Token Broken when Password Changed

Recently, there have been numerous instances where users change their passwords and later discover, typically a month afterward when attempting a Software Update, that they can't proceed. Users often assume their password is incorrect because, during the Software Update process, they receive no error message, only a notification that their access is denied when entering their password.

Repairing a secure token requires the credentials of a user with a valid token and the credentials of the affected user. Consequently, we can only fix a secure token when physically present at the machine and with the user in attendance. This requirement becomes quite restrictive when managing hundreds of users.

There is also no method to verify whether the secure token is corrupted. You can only check if the secure token exists. This limitation further complicates the resolution process.

Is there not a better way?