Hello Chris,
Not sure if I got your point.
I am confused when you say different keys.ini files between runtime and GUI.
We have checked keys.ini files in all the servers of runtime, but do we have to maintain keys.ini files for GUI also, how and where do we do it.
If I try to reset the password of user directly in SAP, it is accepting the same password, but not through IDM. 
Thanks
Aditi
