After upgrading to 3.3 I noticed that some users were getting messages stating their passwords were incorrect. Even if I went into admin mode and verified they were authorized and changed their password, they still were unable to login.

I found out the problem and a way to fix it.

it seems that somewhere during an upgrade (not sure where to be honest) about 450 of 6000+ users in my database either lost or were never given a 'true' value in aspnet_Membership.IsApproved field. Setting this bit field to true fixed the problem right away.

I have no clue as to why this happened. the odd thing is that it happened to a group of users that ranged from 1-2 months old.

I have two theories...

1) the process that added/updated these records during one of my upgrades failed

and/ OR 

2) the new password requirements caused these records to not be approved for not meeting the guidelines (not good, all pre-exisitng users should be approved). I cant be sure about this since I don't know all the passwords involved.


My followup question is why does the user appear authorized in the user manager even though this field is not set to true?

PS.
the following SQL fixed my problem (use at your own risk)

update aspnet_Membership set IsApproved = 1
where Coalesce(IsApproved,0) = 0

This could be due to the password length requirement, which can be set in the web.config file.