/PWDEXPIRED (default)
       /NOPWDEXPIRED

    Specifies the password is valid for only one login. A user must
    change a password immediately after login or be locked out of the
    system. The system warns users of password expiration. A user can
    either specify a new password, with the DCL command SET PASSWORD,
    or wait until expiration and be forced to change. By default, a
    user must change a password when first logging in to an account.
    The default is applied to the account only when the password is
    being modified.

    NOTE: An account with no password lifetime (/NOPWDLIFETIME) will
    not be checked for pre-expired passwords at login.  To have initial
    passwords require a password reset and no effective password
    lifetime, set the password expiration time to "9999-" instead of
    /NOPWDLIFETIME.