we are creating users without checked of you must change password on next logon. Then, when reseting/setting new password we dont check need to change password. Then some user can change they password others need to wait 24h.