Windows – Force a Windows 7 user to change password when it has expired

By creating GPO on OU, This will not work for what you're trying to do. GPOs pertaining to Password policies can only be set at the domain level. However, In order to apply a policy to a subset of domain users then you need to use Fine-Grained password policies.

These can be applied at the group level, so you need to ensure all the users you wish to affect with this new policy are a member of the appropriate group.

To do this on a Windows 2012 domain, do the following from a DC .

1. From the Start Screen type DSAC.EXE to start the Directory Service Administrative Center.
2. Navigate to the System\Password Settings Container
3. Right Click and select New or use New under the Tasks menu.
4. Choose Password Settings
5. Create a New Password policy either for a User or a group.
6. Set its Precedence in case if u have multiple policies created, so lower the number higher the priority.

It's fairly self-explanatory from there.

Since you're asking about RHEL6, I looked at the source code for useradd (which is delivered as part of the 'shadow' package). In useradd.c is a function called new_spent where it sets up a new shadow password entry. There it addresses the "expired password on creation" issue this way:

if (0 == spent->sp_lstchg) {
/* Better disable aging than requiring a password change */
spent->sp_lstchg = -1;

Soooo... If you set a zero it makes it a -1.

The authors of the program have coded specifically against setting the aging to 0 so it won't matter if you set it to 0 in the /etc/default/useradd parameter for EXPIRE. (If it was me doing that code I would have looked to see if the user was setting the password in the command and then allowing the expire, but it wasn't me...)

Also, it was suggested above that you could place a script into /usr/local/sbin/adduser.local to do a 'chage' command. This was good advice for a Debian/Ubuntu system where useradd is a perl script which does indeed run that file if it finds it, but on RHEL the useradd command is a C binary.

If I was you and I was determined to get that behavior on the RHEL6 useradd I'd get the SRPM for the shadow package, comment out those lines above and do an rpmbuild on the package and rockaway. Winning!