I have run into a problem with Cisco ACS v3.1 (win2k)

User accounts are expiring, and when I reset them by moving the account
out of their group and then back in again, the account expires
immediately when the user tries to log in. They have a group setting of
password expiry after 90 days.

The only way around this I have found is to make an exact copy of the
original group with one difference: I have to deselect the "Apply
password change rules" option, the one that forces the user to change
their password at first login.

Has anyone seen this before?