What causes Crowd requiresPasswordChange attribute to become true?

[Shane Doyle]

Is there a list anywhere of what can cause the requiresPasswordChange attribute to flip? We were manually changing the passwordLastChanged attribute and soon after the requiresPasswordChange attribute changed to true. This doesn't seem to be the case, or even possible, but we don't know what else would/could change it. This was a service account that has some old jobs running using old passwords but we do not lockout accounts based on invalid password attempts in this directory. Does anyone know what else causes an account lockout? 

[Diego Berrueta]

Not all directories support this attribute.

Internal directories automatically manage this attribute. If the user password is older than password_max_change_time (this is a configurable attribute of the internal directory), the next successful authentication will set the requiresPasswordChange attribute in the user.

Programatically, this attribute can also be set for all users by calling DirectoryManager.expireAllPasswords().