I don't see anymore this bug in ubuntu 14.04. I tried, in an up to date virtual machine running trusty and joined to an active directory domain, to change an expired password and I was able to do it correctly, either with the original lightdm package (lightdm 1.9.5-0ubuntu1) and either with a recompiled lightdm with PAM_CHANGE_EXPIRED_AUTHTOK in the pam_chauthtok(). auth.log Jan 20 14:39:08 vmt-amb20 lightdm: pam_succeed_if(lightdm:auth): requirement "user ingroup nopasswdlogin" not met by user "domainuser1" Jan 20 14:39:14 vmt-amb20 lightdm: pam_krb5(lightdm:auth): authentication failure; logname=domainuser1 uid=0 euid=0 tty=:0 ruser= rhost= Jan 20 14:39:14 vmt-amb20 lightdm: pam_unix(lightdm:auth): authentication failure; logname= uid=0 euid=0 tty=:0 ruser= rhost= user=domainuser1 Jan 20 14:39:14 vmt-amb20 lightdm: pam_winbind(lightdm:auth): getting password (0x00000388) Jan 20 14:39:14 vmt-amb20 lightdm: pam_winbind(lightdm:auth): pam_get_item returned a password Jan 20 14:39:14 vmt-amb20 lightdm: pam_winbind(lightdm:auth): request wbcLogonUser failed: WBC_ERR_AUTH_ERROR, PAM error: PAM_AUTH_ERR (7), NTSTATUS: NT_STATUS_LOGON_FAILURE, Error message was: Logon failure Jan 20 14:39:14 vmt-amb20 lightdm: pam_winbind(lightdm:auth): user 'domainuser1' denied access (incorrect password or invalid membership) Jan 20 14:39:25 vmt-amb20 lightdm: pam_succeed_if(lightdm:auth): requirement "user ingroup nopasswdlogin" not met by user "domainuser1" Jan 20 14:39:45 vmt-amb20 lightdm: pam_krb5(lightdm:auth): user domainuser1 authenticated as