the command samba-tool user setpassword --must-change-at-next-login should also work without having to set a new password.