I'm analyzing Exchange 2010 log files in depth and see "/rpc/rpcproxy.dll" generating login errors in either one of these ways
HTTP Response 401.1 with a detailed Win32 Response code meaning the account is LockedOut, Disabled, PWExpired
HTTP Response 503.1907 with a Win32 Response code of zero.
Is it correct to assume that the number 1907 means "Password expired and must be changed", and the Win32 Response is zero in error (and should be 1907)?
Do any clients actually respond to this change password prompt? When will it work/not work?