If the Universal Password is enabled, you cannot use the randkey option for setting Universal Password while changing the password of a principal.
Setting the password for a principal associated with a user object sets the Universal Password as the Kerberos password for all the principals that are Universal Password enabled and associated with that user object.
If Universal Password is enabled, you must load the Kerberos Password Agent module whenever the computer or eDirectory is restarted.
The KPA does not support extended characters in a password. If the Kerberos password is integrated with Universal Password, the Universal Password also cannot have extended characters.