Why not changed the password from the user?

When you create a new user in domain Windows Server 2003 Enterprise Edition SP2 with default password 123456 put a tick "to Demand password change at next logon". Everything was working until Monday of last week, well, all the new user with different departments (OSEC) quietly changed the default password on your. Started but the problem is that after the user enters the default password 123456, then enters 2 times your password, press change password, but system responds that you need to change the password before the first login and only the "OK" button. In the end, is not with the password 123456 with any one which was replaced. If the password is to ask without tick "must change password at next logon", the user successfully logs in.
1) GP which lies at the root domain with the root Domain Policy there is a paragraph "security Settings," where many account policies, the screenshots are not posted because the last modified date is in 2014, but if necessary can put.
2) the Time domain and the workstations are the same.

Update 1.
A screenshot of the event log.
July 8th 19 at 16:16
1 answer
July 8th 19 at 16:18
But not for that :) I fixed it. - Timmothy.Thiel commented on July 8th 19 at 16:21

Find more questions by tags Windows ServerActive Directory