[Samba] Domain users with expired account passwords cannot set a new one during login

[akanator]

I'm in the process of setting up a Samba 4 PDC on Debian 8. I've set user passwords to expire after a day for testing purposes. When a user tries to log in when his password has already expired, he only gets a short "The user account has expired." message and then gets sent back to the username/password screen, effectively locking them out. Tested with Windows 10 and Windows 7.

There seems to be a way to get a "Enter your old password and a new password twice" screen instead, but I'm having a hard time finding where to configure that. Can anyone assist?