We have a number of locally installed .Net applications that communicate via web services. Authentication in IIS is handled by Windows Authentication so no additional login is required. We recently began seeing a problem where users are getting a IIS 403 forbidden eror when their password reset falls within the password exiration notification period (7 days at the moment).
As this sometimes happens in the the middle of the day (login in the morning OK, but password reaches < 7 days during the day), this comes as a surprise as they haven't been warned to change their password. Of course, I would expect they should be able to work until the password is expired.
Any idea on what could be happening here? Why would IIS reject a login if the passsword hasn't actually expired? Can we change that behaviour?