My question is that simple:
Can I configure an active directory in a way that when a user wants/needs to change his password, his current one isn't forbidden (if it's in compliance with the current password policy)?
Here is some background:
We recently implemented a blacklist approach against known publicly available passwords (see Troy Hunt's service Pwned Passwords). Now we have some users whose passwords don't expire and there is a chance that they still use a password which is on the blacklist but will never be checked when the user doesn't change his password, since this is the only opportunity to check his password.
Now my idea is to force the user to "change" his password but allow his current one if it's not on the blacklist.
I know that there exists Enforce password history which can be set to 0 but it seems to me that the current one is still not accepted.