Our Help Desk has been resetting user passwords with "user must reset password at next logon" for years.
Recently reset default domain policy for "minimum password age" from 0 days to 5 days.
Now when Help Desk resets user password with user must reset password selected the end user receives a denied message because password was reset in less than 5 days.
Searches only reveal how to delegate permissions to reset password which has been done. Appears the helpdesk change of the password flags the password reset the same as if the user reset the password themselves.