We've had the users set to 'password never expires' whilst the system has been bedded in, however, we've now come to a point where we need to get the password policy enforced. We opted to force all users to change their passwords at next logon as we had issued 'easy' passwords for a smooth transition. This was done simply by checking the 'user must change password at next logon' box in AD under the users properties, however rather than prompting users for a new password at the next logon, the logon was immediately denied.
I tried again to ensure I hadn't entered the password incorrectly, but sure enough, my login is denied with the error 'The logon attempt failed'. I go back into AD and uncheck the 'user must change password at next logon' and I am able to log back in again without an issue.
Once logged in, If I press CTRL, ALT & END and choose 'change a password', It seems like it will allow me to change the password - It prompts for old, new and confirm password, but no matter what I use, it says 'Unable to update the password. The value provided for new password does not meet the length, complexity or history requirements of the domain'. I used randomly generated 24 character passwords with upper and lowercase letters, numbers and symbols... there is just no way it doesn't meet the default 2012 complexity rules.
So I have two questions...
Why would checking this option in AD cause it to deny the user logon?
How can I allow/force my users to change their passwords?