There seems to be a subtle difference between a domain account that has the checkbox "force password change" and an account that merely has an expired password (say after 90 days).
Is there a way to simulate / force an account to "expire" other than changing the policy and impacting all accounts? Are there differences based on the functional level of the domain?