This feature of Directory Server enables administrators to force regular system users to change their passwords after a password reset.
This feature is enabled by the pwd-must-change-enabled property. This property specifies whether a user must change the password when he first binds or after the password has been set or reset. The feature is disabled by default.