There seems to be a bug with Active Directory reporting back the incorrect expiration date for passwords when using Fine Granular Password policies. I have set my password is expire every 160 days via FGPP console. Bizarrely the old command query tools (net user or net accounts) is showing 30 days as the password expiration period for accounts but using PowerShell queries shows the correct expiration period (160 days). Unfortunately Windows client, Apple Mac and OWA is picking up the incorrect expiration period prompting users to change password within 30 days but not forcing them as their account has not technically expired, which is the 160 days. This is very confusing and annoying for the users!
I did have password policies in place using Group Policies but I removed them as needed more granular control on password policies.
Any ideas how to resolve this issue?
Many thanks
Liam