[Samba] Get PasswordMustChangeNow parameter from command line

[Luke Barone]

I am adapting a script that needs to know whether a user needs to change
their password on the next login from NT to AD with Samba.

I have tried "samba-tool user getpassword <user> --attributes
PwdMustChangeNow", but that's not giving me anything useful - just a DN,
and "Got password OK" (even on users that do need the password to change).

Is there another line I can use that will show when a user's password must
change? The OS is Debian 9, running samba 4.5.12-Debian (yes, I know it's
EOL, but it's what the Debian repo has)