Windows 2000 domain password change problem

[Kestrel]

We have a problem here where some users are told by the system that they do not have permission to change their password once it has expired..


Windows 2000 Domain
Windows 2000 Clients
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\LSA\RestrictAnonymous=0 (As this is what just about every site I've found suggests would have been the problem)

This only happens when the password has expired.. should users change their password before expiry, there is no problem.

[icecube]

One of the options you have when you create each user, is "user cannot change password"--somebody could have checked that instead of "user must change password on boot"

[Kestrel]

nope.. already checked that.. group policy forces password change every 40 days.. with 14 day notification.. the only way we can get them working again is to change the password manually and force a change on next login..

but if they leave it until the day the password expires.. they can't change it.. even up to a day beforehand.. it's fine..