I followed this Microsoft article to enforce strong domain user passwords. Before I took this action, some domain users used simple passwords (like 123456). After I enforced strong password policy through GPO, I have confirmed that it takes effect, because changing a password using the iisadmpwd method fails with error message "Either the password is too short or password uniqueness restrictions have not been met" on the webpage.
However, those users' simple passwords are still valid, that is, server software that does Windows AD integration or LDAP integration to verify user identity still accepts old simple passwords, or, more techincally, Windows API
LogonUser still accept old simple passwords. My question is: How can I thoroughly invalidate those simple passwords so that I can force those stubborn users to make a change (call AD admin for a password reset, etc.)?
I think this is a common case but it seems hard to find an answer by just Googling.