Active Directory has a setting that forces a user to change his password upon his next login--visible in the AD Users and Computers applet, when right-clicking a user, selecting Properties, then Account...the very first checkbox in the "Account options" list is labeled "User must change password at next login".
This is not quite what I'm after. I've been tasked to find a way to make sure new AD users are forced to change their password during their first login (as in, the very first time they log in, ever). Is there such a policy? Ideally, I need something that works with Server 2003 domains and above.
Actually, that's not the full story...assuming such a policy exists, what I need to do is write a script that verifies that this is how the policy has been configured (that is, confirm that all new users will have to go through the process of getting their passwords changed).