There exists an attribute on the user REQUIRES_PASSWORD_CHANGE, it would be nice to invalidate all passwords for all users in the directory in one hit (for password policy reasons, for example).

Note that currently this will do very little, the REQUIRES_PASSWORD_CHANGE flag is not respected in many places.