I cannot get Solaris 10 dtlogin to prompt for an expired password. I'm using Samba 3.0.22 on Solaris 10 x86, authenticating to a Win2k3 AD domain controller. We have 5000 users in our environment and have had to turn off expire password on the AD side for all users with a new account and a random password assignment. Is it possible to tweak pam to force dtlogin on Solaris 10 to recognize the expired password and then prompt for the change using dtlogin?