We recently enabled password complexity requirements in our company and I noticed that users already having complex passwords weren't forced to change their password but everyone else was required to.
Now the question is how does AD confirm password complexity when reversible encryption is not enabled? The only way I can think of is to set a policy/flag to do the check for password complexity client-side when the user tries to log in. If the "client machine" notices that the password being used is valid but not complex it initiates the password change procedure.
Can anyone confirm or shed some more light on this?
PS. In our case the AD infrastructure is based on Windows Server 2003 but if there any difference in the way this is done on 2008/R2 info on that is also appreciated.