At my workplace (and I am told many others), several password-requiring systems warn users every day during the two week period before their passwords expire. The warning consists of a dialog box that interrupts the login process with a message like "Your password will expire in 13 days. Would you like to change it now?" The annoyance and inefficiency is obvious: given three systems that do this, I'll have maybe thirty extra dialog boxes that I hit `cancel' on every quarter, plus all that time lost because the usual workflow of log in, get coffee, desktop will be up when I get back turns into log in, get coffee, realize dialog box is waiting, hit cancel, rearrange desk toys while desktop comes up.
But I can't fathom the benefit. Are there studies that have demonstrated that this improves security? Is having some percentage of users who succumb and change their password after 76 days instead of the usual 90-day expiration a real improvement, and if so, why not mandate that all users have to change their passwords after 76 days? Are there common cases where users will be locked out if they have to change their password post-expiration? There has to be a justification somewhere, but I'm just not seeing it.