Are your users authenticated externally (e.g. LDAP or external database)? And is the site version 3.7.1?
This could be MDL-66071 in which case updating to the latest weekly release should resolve this issue. (You could work around this in the short term).
