AD-joined, network account

The password change will apply. Users should be able to authenticate with their new password without issue.

Non-AD-joined, local account

The password change will not apply. Users may want to update their local user account password via System Preferences>Users & Groups to match their AD password.

Non-AD-joined, local account, FileVault-encrypted

Same as non-FV, password should sync to PreBoot

AD-joined, mobile account (cached creds)

The password change will apply, only after the Mac has been connected to a network with AD (via campus or VPN). In testing, this is effectively immediate, but can take some time (login to Mac, change password, connect to VPN, open System Preferences>Users & Groups, unlock pane with new password).

AD-joined, mobile account (cached creds), FileVault-encrypted

Above applies, but after restart, PreBoot may require old password and will not forward to logged-in state (user will be dropped into login window and have to enter new username/password).

To get in sync, enter these commands:

sudo fdesetup list | grep jcarberr   #substitute jcarberr for the shortID of the user out of sync

It will return:

jcarberr,27E97FDA-252E-1D28-97E2-E11278DB2D21

then copy the long UUID and enter:

diskutil apfs changePassphrase disk1s1 -user 27E97FDA-252E-1D28-97E2-E11278DB2D21

You will be prompted for the old password and the current password.